不知道张老师是否听说过rpcdbg.dll?

0:008> !rpcexts.help

Commands for C:\wdbg61332\WINXP\rpcexts.dll:

!IF - Dumps an RPC Interface

!addrvect - Dumps the address vector at the given location

!ama - Displays the ALPC message attributes

!assoctable - Displays an association table

!asyncmsg - Dumps NDR_ASYNC_MESSAGE

!asyncrpc - Dumps RPC_ASYNC_STATE

!authinfo - Dumps CLIENT_AUTH_INFO

!copacket - Dumps CO packet

!dgcc - Dumps DG_CCALL

!dgep - Dumps DG_ENDPOINT

!dgpe - Dumps DG_PACKET_ENGINE

!dgpkt - Dumps DG_PACKET

!dgpkthdr - Dumps NCA_PACKET_HEADER

!dgsc - Dumps DG_SCALL

!dict - Dumps SDICT

!dict2 - Dumps SDICT2

!eeinfo - Prints the extended error info chain

!eerecord - Prints the extended error info record given

!error - Translates an error value into the error message

!fwscan - Searches for a string pattern in the RpcFw log

!getcallinfo - Searches the system for call info

!getclientcallinfo - Searches the system for client call info

!getdbgcell - Gets info for the specified cell

!getendpointinfo - Searches the system for endpoint info

!getthreadinfo - Searches the system for thread info

!getvalidateerror - Dumps error code for the failed VALIDATE

!help - Displays information on available extension commands

!listcalls - Dumps addresses, associations, and calls active within

the RPC_SERVER at address

!lpcaddr - Dumps LRPC_ADDRESS

!lpcbh - Dumps LRPC_BINDING_HANDLE

!lpcca - Dumps LRPC_CASSOCIATION

!lpcccall - Dumps LRPC_CCALL

!lpcsa - Dumps LRPC_SASSOCIATION

!lpcscall - Dumps LRPC_SCALL

!mode - Switches the extensions to debug one of these 3 modes

(rpcrt4, msrpc, rhttpaa). Default is rpcrt4

!obj - Dumps an RPC Object

!overlap - Dumps object associated with OVERLAPPED pointer

!pasync - Dumps RPC_ASYNC_STATE

!pipedesc - Dumps NDR_PIPE_DESC

!pipemsg - Dumps NDR_PIPE_MESSAGE

!pipestate - Dumps NDR_PIPE_STATE

!protocols - Dumps PnP protocols map & related objects

!queue - Dumps QUEUE

!rpcheap - Dumps rpc heap on checked builds

!rpcmsg - Dumps RPC_MESSAGE

!rpcreadstack - Reads an RPC client side stack and retrieves the call

info

!rpcsvr - Dumps RPC_SERVER

!rpctime - Displays current system time

!rpcverbosestack - Toggles the state of the verbose spew when reading the

stack

!rpcverifier - Dumps the RPC verifier settings

!scan - Dumps the event log

!secinfo - Dumps security provider/package info

!sizes - Prints sizes of the data structures

!stackmatch - Matches stack symbols and target addresses

!stubmsg - Dumps MIDL_STUB_MESSAGE

!thread - Dumps the RPCRT4 thread object

!traceasynccall - Traces an LRPC call chain starting with a given

RPC_ASYNC_STATE object

!tracesynccall - Traces an LRPC call chain starting with a given thread

!trans - Dumps most NT RPC transport objects

!transinfo - Dumps TRANS_INFO

!version - Prints version information for the current rpc extension

library

!help <cmd> will give more information for a particular command

不知道张老师是否听说过rpcdbg.dll?

Windows内核调试

不知道张老师是否听说过rpcdbg.dll?

Re: 不知道张老师是否听说过rpcdbg.dll?