Switch kernel mode debug to user mode debug

最新推荐文章于 2024-09-01 00:15:00 发布

转载最新推荐文章于 2024-09-01 00:15:00 发布 · 752 阅读

文章标签：

#user #command #module #action #access #list

技术探秘专栏收录该内容

30 篇文章

订阅专栏

本文介绍了如何在Windows XP及后续版本中，通过使用'.process'命令来强制进入目标进程上下文，从而进行有效的用户模式调试。此外，还提供了加载用户模式模块列表和符号的方法，并在必要时切换到用户模式下设置断点。

1) Process context - You're not necessarily in the correct process context when you break in with the debugger, so you need to force the correct process context somehow

2) The user mode module list and symbols aren't loaded by default, but you can load them with .reload /user

You're better off using .process /i if your target is XP and later, that will actually force a switch into the target process context (you hit Go in the debugger and then the target breaks in when that process context gets swapped in). If I need to set a breakpoint in a user mode process I usually:

.process /i <process address>
g
* Debuggee runs, breaks in sometime later *
.reload /user
ba e1 foo!bar

And you should be set.

Martin gave you a link to an alternate option, where you actually run a user mode debugger on the target machine and control it via the kernel connection. Very nifty as it gives you access to the user mode debugger commands as opposed to the kernel mode debugger commands, though it requires action on the target.

Try using command: ".process" and ".thread". For example:
1. for find process: !process 0 0 my_tool.exe
2. for switch context: .process /r/p <_EPROCESS_ADDR>