Windbg
Windbg观察窗口的NTSTATUS将十进制改为十六进制显示
2023-06-21
30
0
在Windbg里调试驱动时，NTSTATUS Status的值总显示为on-1**的十进制形式，非常不利于我们查看其对应的问题。如下：
这时，我们只需要使用dd命令显示变量的值即可。
2: kd> dd s
ffff8000`56fbf840 c0000010 fffff803 00000030 00000002
ffff8000`56fbf850 00000801 00000000 5dae2980 ffff9d8c
ffff8000`56fbf860 22461f75 ffffd32d 000001c8 00000000
ffff8000`56fbf870 56fbf9f0 ffff8000 c6191e3a fffff803
ffff8000`56fbf880 5e828060 ffff9d8c 00000000 00000000
ffff8000`56fbf890 c8a54bd0 ffffb183 00000000 00000000
ffff8000`56fbf8a0 0000001b ffff9d8c 56fbf9f0 ffff8000
ffff8000`56fbf8b0 098c1a20 ffff9d8c c6197020 fffff803
dd不光可以显示某个地址的内容，也可以显示某个变量或者寄存器指向的地址的值。
显示变量
ULONG nNum = 2;
2: kd> dd nNum
ffff8000`56fbf84c 00000002 00000801 00000000 5dae2980
ffff8000`56fbf85c ffff9d8c 22461f75 ffffd32d 000001c8
ffff8000`56fbf86c 00000000 56fbf9f0 ffff8000 c6191e3a
ffff8000`56fbf87c fffff803 5e828060 ffff9d8c 00000000
ffff8000`56fbf88c 00000000 c8a54bd0 ffffb183 00000000
ffff8000`56fbf89c 00000000 0000001b ffff9d8c 56fbf9f0
ffff8000`56fbf8ac ffff8000 098c1a20 ffff9d8c c6197020
ffff8000`56fbf8bc fffff803 5e828060 ffff9d8c 5f178000
显示寄存器
2: kd> r eax
eax=c0000010
2: kd> dd rax
00000000`c0000010 ???????? ???????? ???????? ????????
00000000`c0000020 ???????? ???????? ???????? ????????
00000000`c0000030 ???????? ???????? ???????? ????????
00000000`c0000040 ???????? ???????? ???????? ????????
00000000`c0000050 ???????? ???????? ???????? ????????
00000000`c0000060 ???????? ???????? ???????? ????????
00000000`c0000070 ???????? ???????? ???????? ????????
00000000`c0000080 ???????? ???????? ???????? ????????
