为什么 lm 命令不显示模块?
Why lm command doesn't show a module?
我在虚拟机中打开了一个计算器,但是当尝试使用命令 lm
从 windbg 查看它时,它没有显示。
kd> !process 0 0 calc.exe
PROCESS ffffe0000046a080
SessionId: 1 Cid: 0144 Peb: 7ff7f76df000 ParentCid: 0868
DirBase: 18290000 ObjectTable: ffffc000031739c0 HandleCount: <Data Not Accessible>
Image: calc.exe
kd> .process ffffe0000046a080
Implicit process is now ffffe000`0046a080
kd> !peb
PEB at 00007ff7f76df000
InheritedAddressSpace: No
ReadImageFileExecOptions: No
BeingDebugged: No
ImageBaseAddress: 00007ff7f8060000
Ldr 00007ffdc286f3c0
Ldr.Initialized: Yes
Ldr.InInitializationOrderModuleList: 0000008db0261ae0 . 0000008db028fb60
Ldr.InLoadOrderModuleList: 0000008db0261c40 . 0000008db028fb40
Ldr.InMemoryOrderModuleList: 0000008db0261c50 . 0000008db028fb50
Base TimeStamp Module
7ff7f8060000 5215ed3e Aug 22 05:51:42 2013 C:\Windows\system32\calc.exe
7ffdc2740000 523d5305 Sep 21 03:04:21 2013 C:\Windows\SYSTEM32\ntdll.dll
7ffdc03e0000 523d5199 Sep 21 02:58:17 2013 C:\Windows\system32\KERNEL32.DLL
7ffdbfec0000 523d557d Sep 21 03:14:53 2013 C:\Windows\system32\KERNELBASE.dll
更改上下文没有帮助,但我不得不尝试一下。我记得把calc列在列表的最前面,但我不知道在什么情况下
kd> lm
start end module name
fffff800`00000000 fffff800`00088000 CI (deferred)
fffff800`0008a000 fffff800`000f0000 mcupdate_GenuineIntel (deferred)
fffff800`000f0000 fffff800`000fe000 werkernel (deferred)
...
要么使用 .process /p /r
或使用
.reload /用户
用于列出您的用户模式模块
kd> !process 0 0 calc.exe
PROCESS 865a3030 SessionId: 1 Cid: 0fe4 Peb: 7ffda000 ParentCid: 0850
DirBase: 7e24a6e0 ObjectTable: c44a2df0 HandleCount: 81.
Image: calc.exe
kd> .process 865a3030
Implicit process is now 865a3030
kd> lm m calc*
Browse full module list
start end module name
kd> .reload /user
Loading User Symbols
kd> lm m calc*
Browse full module list
start end module name
00e00000 00ec0000 calc (deferred)
或
kd> !process 0 0 calc.exe
PROCESS 865a3030 SessionId: 1 Cid: 0fe4 Peb: 7ffda000 ParentCid: 0850
DirBase: 7e24a6e0 ObjectTable: c44a2df0 HandleCount: 81.
Image: calc.exe
kd> .process 865a3030
Implicit process is now 865a3030
kd> lm m calc*
Browse full module list
start end module name
kd> .process /p /r 865a3030
Implicit process is now 865a3030
Loading User Symbols
kd> lm m calc*
Browse full module list
start end module name
00e00000 00ec0000 calc (deferred)
按照blabb所说的去做后,它确实显示了它,实际上不仅列出了内核内存(fffff8 ...)而且还列出了用户内存(00007 ..)。
kd> lm
start end module name
00007ff7`35260000 00007ff7`35346000 calc (deferred)
00007ffa`f7500000 00007ffa`f7563000 oleacc (deferred)
[...]
00007ffa`fcbe0000 00007ffa`fcd89000 ntdll (deferred)
fffff800`00000000 fffff800`0005f000 volmgrx (deferred)
[...]
fffff800`000dd000 fffff800`0013f000 CLFS (deferred)
我在虚拟机中打开了一个计算器,但是当尝试使用命令 lm
从 windbg 查看它时,它没有显示。
kd> !process 0 0 calc.exe
PROCESS ffffe0000046a080
SessionId: 1 Cid: 0144 Peb: 7ff7f76df000 ParentCid: 0868
DirBase: 18290000 ObjectTable: ffffc000031739c0 HandleCount: <Data Not Accessible>
Image: calc.exe
kd> .process ffffe0000046a080
Implicit process is now ffffe000`0046a080
kd> !peb
PEB at 00007ff7f76df000
InheritedAddressSpace: No
ReadImageFileExecOptions: No
BeingDebugged: No
ImageBaseAddress: 00007ff7f8060000
Ldr 00007ffdc286f3c0
Ldr.Initialized: Yes
Ldr.InInitializationOrderModuleList: 0000008db0261ae0 . 0000008db028fb60
Ldr.InLoadOrderModuleList: 0000008db0261c40 . 0000008db028fb40
Ldr.InMemoryOrderModuleList: 0000008db0261c50 . 0000008db028fb50
Base TimeStamp Module
7ff7f8060000 5215ed3e Aug 22 05:51:42 2013 C:\Windows\system32\calc.exe
7ffdc2740000 523d5305 Sep 21 03:04:21 2013 C:\Windows\SYSTEM32\ntdll.dll
7ffdc03e0000 523d5199 Sep 21 02:58:17 2013 C:\Windows\system32\KERNEL32.DLL
7ffdbfec0000 523d557d Sep 21 03:14:53 2013 C:\Windows\system32\KERNELBASE.dll
更改上下文没有帮助,但我不得不尝试一下。我记得把calc列在列表的最前面,但我不知道在什么情况下
kd> lm
start end module name
fffff800`00000000 fffff800`00088000 CI (deferred)
fffff800`0008a000 fffff800`000f0000 mcupdate_GenuineIntel (deferred)
fffff800`000f0000 fffff800`000fe000 werkernel (deferred)
...
要么使用 .process /p /r
或使用
.reload /用户
用于列出您的用户模式模块
kd> !process 0 0 calc.exe
PROCESS 865a3030 SessionId: 1 Cid: 0fe4 Peb: 7ffda000 ParentCid: 0850
DirBase: 7e24a6e0 ObjectTable: c44a2df0 HandleCount: 81.
Image: calc.exe
kd> .process 865a3030
Implicit process is now 865a3030
kd> lm m calc*
Browse full module list
start end module name
kd> .reload /user
Loading User Symbols
kd> lm m calc*
Browse full module list
start end module name
00e00000 00ec0000 calc (deferred)
或
kd> !process 0 0 calc.exe
PROCESS 865a3030 SessionId: 1 Cid: 0fe4 Peb: 7ffda000 ParentCid: 0850
DirBase: 7e24a6e0 ObjectTable: c44a2df0 HandleCount: 81.
Image: calc.exe
kd> .process 865a3030
Implicit process is now 865a3030
kd> lm m calc*
Browse full module list
start end module name
kd> .process /p /r 865a3030
Implicit process is now 865a3030
Loading User Symbols
kd> lm m calc*
Browse full module list
start end module name
00e00000 00ec0000 calc (deferred)
按照blabb所说的去做后,它确实显示了它,实际上不仅列出了内核内存(fffff8 ...)而且还列出了用户内存(00007 ..)。
kd> lm
start end module name
00007ff7`35260000 00007ff7`35346000 calc (deferred)
00007ffa`f7500000 00007ffa`f7563000 oleacc (deferred)
[...]
00007ffa`fcbe0000 00007ffa`fcd89000 ntdll (deferred)
fffff800`00000000 fffff800`0005f000 volmgrx (deferred)
[...]
fffff800`000dd000 fffff800`0013f000 CLFS (deferred)