|
对于虚拟机场景。虚机是windows7(7601.24499)，host机是linux。我想调试虚机。现有一种在host上dump出虚机内存的方法。 python2 vol.py --profile=Win7SP1x64_24000 --plugins=raw2dmp -f 1.virshdmp raw2dmp --output-image=1.dmp 然后用windbg打开1.dmp，一开始windbg提示 16.0: kd:x86> !wow64exts.sw
Switched to Host mode 遂得到 随便载入一个线程，例如.thread explorer的0号线程。奇怪的是，用r查看寄存器，都是有的，k也能得到栈回溯。但是dp rsp的时候，似乎windbg，总是把寄存器当作16位数字而非64位，因此无法看到栈区数据。
也试过.effmach amd64, .effmach x86。没效果。不知道怎么办了。请教一下大家。多谢了！
16.0: kd> r
Last set context:
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80004ca815a rsp=fffff88002824ec0 rbp=fffffa800681f820
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl nz na pe nc
cs=0000 ss=0000 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000
16.0: kd> k
*** Stack trace for last set context - .thread/.cxr resets it
# Child-SP RetAddr Call Site
00 fffff880`02824ec0 fffff800`04c43c82 nt!KiSwapContext+0x7a
01 fffff880`02825000 fffff800`04c51802 nt!KiCommitThreadWait+0x1d2
02 fffff880`02825090 fffff800`04f15575 nt!KeWaitForMultipleObjects+0x272
03 fffff880`02825350 fffff800`04f1af9d nt!ObpWaitForMultipleObjects+0x295
04 fffff880`02825820 fffff800`04cb3d53 nt!NtWaitForMultipleObjects+0xe5
05 fffff880`02825a70 00000000`77319e3a nt!KiSystemServiceCopyEnd+0x13
06 00000000`001497b8 00000000`00000000 0x77319e3a
16.0: kd> dp rsp
0000:4ec0 ????????`???????? ????????`????????
0000:4ed0 ????????`???????? ????????`????????
0000:4ee0 ????????`???????? ????????`????????
|