Add notes

This commit is contained in:
yrp
2019-07-30 20:07:37 -07:00
parent 1b6520e564
commit a6b3f77b2d
2 changed files with 17 additions and 3 deletions
+16 -2
View File
@@ -4,9 +4,23 @@ A windbg-js plugin to dump the cpu state.
## Usage
You'll probably want the VM to have 1 vCPU. Sometimes kd gets confused about
which CPU scripts run on. Additionally, once you hit your bp you should verify
that `GSBASE` and `KERNEL_GSBASE` are different:
```
0: kd> .scriptload c:\path\to\bdump.js
0: kd> !bdump "c:\\path\\to\\dump"
kd> rdmsr c0000101
msr[c0000101] = 0x41414141
kd> rdmsr c0000102
msr[c0000102] = 0x42424242
```
If they are the same, youll need to hit the bp again. I have no idea why this
happens.
```
kd> .scriptload c:\path\to\bdump.js
kd> !bdump "c:\\path\\to\\dump"
```
This will create two files:
+1 -1
View File
@@ -318,7 +318,7 @@ function __bdump(path) {
logln('[bdump] register fixups...');
__fixup_regs(regs);
__save_regs(path, regs);
logln('[bdump] saving mem...');
logln('[bdump] saving mem, get a coffee or have a smoke, this will probably take around 10-15 minutes...');
__save_mem(path);
logln('[bdump] done!');