|
.reload /f
|
.sympath .SRVC:\symhttp://msdl.microsoft.com/download/symbols/
|
|
x modulename!symbolname
|
search for function or symbols
|
|
$iment(module)
|
entry point of module
|
|
!drvobjt <name>
|
find drive
|
|
!devobj <name>
|
device object
|
|
!devhandles <handle>
|
app using drive
|
|
bp 0x<addr>
|
set breakpoint at address
|
|
bl
|
brakpoints
|
|
bd <#>
|
disable breakpoint#
|
|
bc <#>
|
clear brakpoint#
|
|
be <#>
|
enable breakpoint #
|
|
ba [r|w|e] 0x<addr>
|
break on [read|write|execute]
|
|
bu <symbolname>
|
break on symbol
|
|
sxe ld:dllname
|
break on module load
|
|
g or F5
|
continue
|
|
p or F10
|
step over
|
|
t or F11
|
step into
|
|
Shift + F11
|
step out
|
|
wt
|
trace and watch
|
|
pa or ta 0x<addr>
|
step to address
|
|
pc or tc
|
step to next call
|
|
pt or tt
|
step to next return
|
|
pct or tct
|
step to next call or return
|
|
ph or th
|
step to next branch
|
|
F6 or .attach
|
attach to process
|
|
.detach
|
detach to process
|
|
.restart
|
retstart
|
|
q
|
quit
|
|
a
|
~<a><b>
|
|
*
|
all threads
|
|
.
|
current threads
|
|
<#>
|
thread ordinal number
|
|
b
|
~<a><b>
|
|
e
|
exectue
|
|
f
|
freeze
|
|
u
|
ufreeze
|
|
n
|
supsend
|
|
m
|
resume
|
|
empty lists threads
|
|
|
k
|
dump all stack
|
|
r
|
dmp registers
|
|
!teb
|
dump TEB
|
|
!peb
|
dump PEB
|
|
!vadump
|
dump mem pages/info
|
|
!heap
|
dump heap
|
|
lm
|
list loaded modules
|
|
ln
|
list close symbol at memory address
|
|
!idt
|
interrupt descriptor table
|
|
dt modulename!symbolname 0x<addr>
|
dump structure for symbol
|
|
u 0x<addr> L<addr>
|
disassemble at addr L# instructions
|
|
d* 0x<addr>
|
|
|
a
|
ascii chars
|
|
u
|
|
No comments yet.
Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.
