windbg 要怎麼切換從32至64bits 模式: .effmach x86 或 !wow64exts.sw

(原文出處: How do I switch to 32bit mode when I use windbg to debug a dump of a 32bit application running on an x64 machine? )

這篇文章裡面會介紹, 當你使用windbg來除錯一個dump檔
而它又是32bits的應用程式跑在x64機器上的dump檔, 如何從 32bit mode切換到 x64 machine.

假如你是32bit或64bit版本的windbg, 去開啟 32bit Application跑在x64作業系統上的Dump檔, 預設就是指你用64bit的模式去看32bit的application, 如下例, 會出現很多 wow64xxxx的字串

這些wow64xxxx的字串在這些call stack根本無法給我們想要的訊息!
The wow64 stuff in the call stack and the x64 registers do not tell us much.

切換成用32bit的視角來看吧! 透過 .effmach x86 或 !wow64exts.sw 就可以囉!
To get the meaningful 32bit look of the application, you need to switch the processor mode that the debugger uses to 32bit by entering either .effmach x86 or !wow64exts.sw in windbg. The two commands are basically same. You should see output like the following:

果然看起來很不一樣吧!
The call stack looks very different now. Particularly you do not see any wow64 and wow64cpu modules in the stack.

以上的方法也適用於x64 kernel dump 在32bits處理器
Note: The above solution works for the kernel mode dump of an x64 system too when you try to see the thread call stacks of a running 32bit process.

發表迴響

Copy Protected by Chetan's WP-Copyprotect.