Windbg 忽略更改寄存器以克服访问冲突

Question

我正在尝试使用 WinDbg 在我的程序中调试访问冲突。调试器正确捕获访问冲突:

(2604.1e74): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0808e7fb ebx=007b39f8 ecx=000116e7 edx=7ead8618 esi=00000000 edi=00000000
eip=006ed845 esp=0818ff24 ebp=0818ff30 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
image00400000!t_control.is_focused+0x15:
006ed845 8b8051070000    mov     eax,dword ptr [eax+751h] ds:002b:0808ef4c=????????

我想“跳过”访问冲突，以便我可以继续调试(例如，退出故障函数以检查调用者的数据结构)。所以我改了 eax以便它指向可读内存，例如当前代码，所以我这样做:

0:025> r eax=eip

这似乎工作正常，因为以下验证似乎表明:

0:025> r
eax=006ed845 ebx=007b39f8 ecx=000116e7 edx=7ead8618 esi=00000000 edi=00000000
eip=006ed845 esp=0818ff24 ebp=0818ff30 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
image00400000!t_control.is_focused+0x15:
006ed845 8b8051070000    mov     eax,dword ptr [eax+751h] ds:002b:006edf96=012c0000

但是，一旦我尝试单步执行(或继续)程序，它就会以完全相同的方式再次出错，就好像寄存器根本没有改变:

0:025> p
(2604.1e74): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0808e7fb ebx=007b39f8 ecx=000116e7 edx=7ead8618 esi=00000000 edi=00000000
eip=006ed845 esp=0818ff24 ebp=0818ff30 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
image00400000!t_control.is_focused+0x15:
006ed845 8b8051070000    mov     eax,dword ptr [eax+751h] ds:002b:0808ef4c=????????

我究竟做错了什么？ (调试对象是用 Delphi 编写的 32 位程序，在 WinDbg X86 下运行，在 64 位 Windows 7 上运行。调试对象和 WinDbg 都没有运行提升。)

Answer 1

你必须使用

gh (Go with Exception Handled)

操作 eax 寄存器后继续

(2f14.1950): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=7efde000 ecx=94a31deb edx=0f709488 esi=0033f99c edi=0033fa80
eip=000d1a3f esp=0033f99c ebp=0033fa80 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
SimpleCrash!wmain+0x3f:
000d1a3f 8b08            mov     ecx,dword ptr [eax]  ds:002b:00000000=????????

0:000> r @eax=@eip
0:000> gh
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=77882100 edi=778820c0
eip=7779fcc2 esp=0033f9e8 ebp=0033fa04 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtTerminateProcess+0x12:
7779fcc2 83c404          add     esp,4