windbg - 每次命中时如何在windbg中从执行中跳过一行？

Question

假设我想在每次调用函数 func 时跳过它的第 3 行

int func() {
     int a = 10, b =20;
     a = 25;
     b = 30;
     return a+b
}

所以每次它都应该返回 40(即不执行第三行 a=25)
在windbg 中是否有类似gdb 中的jmp 的命令？

Answer 1

又是一个很晚的答案，但如果搞乱组装不是可取的
设置条件断点以跳过执行一行

在下面的示例中 401034 是您不想执行的行
所以在该行设置一个条件断点以跳过它
bp 401034 "r eip = @$eip + size of current instruction";gc" 7 在这种情况下 gc = go从有条件休息

jmptest:\>dir /b
jmptest.c

jmptest:\>type jmptest.c
#include <stdio.h>
int func()
{
    int a = 10 , b = 20;
    a = 25;
    b = 30;
    return a+b;
}
int main (void)
{
    int i , ret;
    for (i= 0; i< 10; i++)
    {
        ret = func();
        printf("we want 40 we get %d\n",ret);
    }
    return 0;
}
jmptest:\>cl /nologo /Zi jmptest.c
jmptest.c

jmptest:\>dir /b *.exe
jmptest.exe

jmptest:\>cdb -c "uf func;q" jmptest.exe | grep 401
00401020 55              push    ebp
00401021 8bec            mov     ebp,esp
00401023 83ec08          sub     esp,8
00401026 c745fc0a000000  mov     dword ptr [ebp-4],0Ah
0040102d c745f814000000  mov     dword ptr [ebp-8],14h
00401034 c745fc19000000  mov     dword ptr [ebp-4],19h
0040103b c745f81e000000  mov     dword ptr [ebp-8],1Eh
00401042 8b45fc          mov     eax,dword ptr [ebp-4]
00401045 0345f8          add     eax,dword ptr [ebp-8]
00401048 8be5            mov     esp,ebp
0040104a 5d              pop     ebp
0040104b c3              ret

jmptest:\>cdb -c "bp 401034 \"r eip = 0x40103b;gc\";g;q " jmptest.exe | grep wan
t
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40
we want 40 we get 40

jmptest:\>