符号配置

SRV*d:\Symbols*http://msdl.microsoft.com/download/symbols

启动自动附加

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe]

"Debugger"="\"D:\\WinDbg(x64)\\windbg.exe\""

加载模块断点

sxe ld:[dll name]

所有模块

sxe ld:*

卸载模块断点

sxe ud:[dll name]

卸载所有模块

sxe ud:*

显示所有线程堆栈

~*kb

内存dump

.writemem path startaddr endaddr

字符串搜索

s -sa 01570000 L61000 搜索ascii

s -su 01570000 L61000 搜索unicode

s -a 0 L?80000000 "to_search" 搜索指定字符串

开页堆

gflags.exe /i test.exe +hpa

模块加载记录

bm msxml6!* ".frame;gc"

sxe ld msxml6
bm /a msxml6!DOMDocument* ".echo callstack; k L5; .echo ESP; dc esp L8; .echo return value; pt;"

https://research.checkpoint.com/2018/50-adobe-cves-in-50-days/

调试子进程

set follow-fork-mode child