mirror of
https://github.com/yrp604/bdump
synced 2026-06-08 18:32:32 +00:00
Add notes
This commit is contained in:
@@ -4,9 +4,23 @@ A windbg-js plugin to dump the cpu state.
|
||||
|
||||
## Usage
|
||||
|
||||
You'll probably want the VM to have 1 vCPU. Sometimes kd gets confused about
|
||||
which CPU scripts run on. Additionally, once you hit your bp you should verify
|
||||
that `GSBASE` and `KERNEL_GSBASE` are different:
|
||||
|
||||
```
|
||||
0: kd> .scriptload c:\path\to\bdump.js
|
||||
0: kd> !bdump "c:\\path\\to\\dump"
|
||||
kd> rdmsr c0000101
|
||||
msr[c0000101] = 0x41414141
|
||||
kd> rdmsr c0000102
|
||||
msr[c0000102] = 0x42424242
|
||||
```
|
||||
|
||||
If they are the same, youll need to hit the bp again. I have no idea why this
|
||||
happens.
|
||||
|
||||
```
|
||||
kd> .scriptload c:\path\to\bdump.js
|
||||
kd> !bdump "c:\\path\\to\\dump"
|
||||
```
|
||||
|
||||
This will create two files:
|
||||
|
||||
@@ -318,7 +318,7 @@ function __bdump(path) {
|
||||
logln('[bdump] register fixups...');
|
||||
__fixup_regs(regs);
|
||||
__save_regs(path, regs);
|
||||
logln('[bdump] saving mem...');
|
||||
logln('[bdump] saving mem, get a coffee or have a smoke, this will probably take around 10-15 minutes...');
|
||||
__save_mem(path);
|
||||
|
||||
logln('[bdump] done!');
|
||||
|
||||
Reference in New Issue
Block a user