MS Windows Debuggers
WinDbg can be used to do user mode debug of applications running on the same
machines as the debugger, but because it is common to stop instruction execution
on the processor during debugging, especially for kernal mode code like device
drivers, it is best to use two systems. One hosts the debug user interface
and the other runs the code being debugged. They must be connected via a
cable of some sort; prior to Win 8 USB or serial cables are necessary, but
with Win 8 and above, the network can also be used. In some situations, it
is possible that the second system is a virtual system, for example, a virtual
PC that is running on the same PC; however, if you are working with code
that closely accesses hardware, this is not a good idea.
WinDbg can also be used to open and analyse crash dump files.
-
Win
10
https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit
(under "Get debuggin tools")
-
Win 7, Vista, Server
2k8
https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit
(under "Other WDK downloads")
-
XP,2K,NT: debugger is at
http://www.microsoft.com/ddk/debugging/installx86.asp
(wayback)
-
ME: The Windows ME debugger is
http://www.microsoft.com/ddk/debugging/download/WINMEDDK.EXE
-
95,98,NT: The Windows 2000 Platform SDK has a (very nice) GUI and
remote (for kernels) debugger for Windows 9x & NT available free at
http://www.microsoft.com/msdownload/platformsdk/windbg.htm
(cache)
The debugger tool provided on the
Windows 98 DDK is the
Windows System Debugger (Wdeb386.exe)
(docs).
It requires a remote computer connected via a cable to the target computer.
Debug binaries and components are provided for Windows 98 in the \dbg_sym
directory on the Windows 98 DDK distribution CD.
-
Note that if you are viewing a range of memory starting before a section
that is committed and ending inside the section that is committed, all the
memory will show as being undefined ("??" in place of values). For example,
if you VirtualAlloc some memory with MEM_COMMIT and then point edi at the
first byte of it and view edi-20 (so you can later see what was stosb'd to
edi) the entire view will fill with "??" If "Reevaluate Expression Always"
is enabled for the view, when edi advances enough that then entire view is
defined, the ?'s will suddenly dissappear.
See also:
file: /Techref/language/asm/debugs.htm, 3KB, , updated: 2016/11/2 14:24, local time: 2024/12/24 22:18,
|
| ©2024 These pages are served without commercial sponsorship. (No popup ads, etc...).Bandwidth abuse increases hosting cost forcing sponsorship or shutdown. This server aggressively defends against automated copying for any reason including offline viewing, duplication, etc... Please respect this requirement and DO NOT RIP THIS SITE. Questions? <A HREF="http://linistepper.com/Techref/language/asm/debugs.htm"> MS Windows Debuggers</A> |
Did you find what you needed?
|