我正在尝试在条件断点中利用“gu”命令或在常规断点中将其用作“CommandString”。例如,当我们想在日志中查看分配的指针和分配的大小时,让我们考虑在 malloc() 函数上中断:
bp msvcrt!malloc "r $t1=@rcx; gu; .printf \"malloc: %p %08x\\n\",@rax,@$t1; gc"
tldr:所以,我们创建了一个临时寄存器$t1,将它分配给分配的大小(arch是x64,因此@rcx = "size"),使用“gu”命令浸出函数,最后打印@rax 上的指针加上我们的临时寄存器值。您可以使用“notepad.exe”自行尝试;)
它有点工作,我们可以看到数据:
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d42c0 00000100
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4700 00000088
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d47c0 00000088
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4880 00000038
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4f10 000000f0
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d5030 00001124
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d6190 00002430
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d85f0 00000200
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d8820 00000080
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d88d0 00000080
唯一的小例外是嘈杂的字符串“某些命令被跳过,因为先前的命令导致事件处理程序内的目标执行。”。当我们使用“gu”作为“CommandString”时,它似乎总是在日志中。
任何想法如何摆脱它或解决此类问题的预期方法是什么?
问候!