本文介绍如何使用Windbg在内核模式下为用户空间的应用程序设置断点。首先，通过运行!process00命令显示所有活动进程的信息。接着选择目标进程并切换到该进程上下文，最后设置所需的断点。
how to use windbg running in kernel mode to set break point in user space?
1. run command "!process 0 0" to display the information of all active process.
the followed information is from process ConsoleApplication3.exe:
PROCESS ffffe00027198380
SessionId: 1 Cid: 100c Peb: 7fa0d000 ParentCid: 0b8c
DirBase: 71774000 ObjectTable: ffffc00192b82740 HandleCount: <Data Not Accessible>
Image: ConsoleApplication3.exe
2. run command ".process /i /p ffffe00027198380"
3. You need to continue execution (press 'g' <enter>) for the context to be switched.
4. When the debugger breaks in again, you will be in the ConsoleApplication3.exe process context.
5. set breakpoints for ConsoleApplication3.exe.
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
