windbg 源码调试（驱动层）

ゝ一世哀愁。 2022-01-20 00:37 411阅读 0赞

参考：

[https://www.cnblogs.com/QKSword/p/10479702.html][https_www.cnblogs.com_QKSword_p_10479702.html]

win7 驱动测试环境设置：

1.设置系统测试环境：

![20190610143411728.png][]

2.对驱动进行签名：

![2019061014345976.png][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70][]

一．源码调试：

1.双机调试连接虚拟机（win7 32 ）：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 1][]

2.设置符号路径：

.sympath+ D:\\TestCode\\Driver\\WD\_VS2013\\Checked\_win7

![20190610143746357.png][]

3.设置源码路径：

.srcpath+ D:\\TestCode\\Driver\\WD\_VS2013

![20190610143800784.png][]

4. 驱动文件，入口点：

![20190610143821541.png][]

![20190610143838743.png][]

5.设置断点 bu WD!DriverEntry （bu Set Unresolved Breakpoint）：

![20190610143851765.png][]

6. g运行系统，使用驱动加载器加载驱动：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 2][]

7.Load 命中入口点断点

![20190610144001628.png][]

8. 可以ctrl+o 打开其他的源文件 按f9 下断点。

二、无源码调试：

1.windbg连接虚拟机，进行双机调试

2.用cffExplorer 查看入口点偏移：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 3][]

3.下偏移断点 ( bp WD+0x1160）：

![20190610144241567.png][]

4.启动驱动：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 4][]

5. 用ida打开WD.sys

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 5][]

6. 调试驱动

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 6][]

三. 文件下载URL（驱动使用的别人的模板）:

[https://download.csdn.net/download/huanongying131/11233693][https_download.csdn.net_download_huanongying131_11233693]

[https_www.cnblogs.com_QKSword_p_10479702.html]: https://www.cnblogs.com/QKSword/p/10479702.html
[20190610143411728.png]: /images/20220120/6044c9a212df48e2a67bc0b74815d59a.png
[2019061014345976.png]: /images/20220120/402ef08a3994435f87bf1a66901f67a1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70]: /images/20220120/9ece2283a9f04e7192906465ee899b3d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 1]: /images/20220120/a285dabef9e6413381040e3bc1e39d3a.png
[20190610143746357.png]: /images/20220120/78e3ed4f93714bd7afcaa6191f800b38.png
[20190610143800784.png]: /images/20220120/c95e6f8a928341d5840ba63f922cd615.png
[20190610143821541.png]: /images/20220120/b810d429204543348450caf949bc3ba6.png
[20190610143838743.png]: /images/20220120/50aad03ba9d74c04b129fcbd8debdf3a.png
[20190610143851765.png]: /images/20220120/284a2623a4d54df4ae2c0bf017aeb88b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 2]: /images/20220120/a4eab0c0b95b4741b564ed1bbe56d34d.png
[20190610144001628.png]: /images/20220120/4c89abce93fc492a9d84981096c7d519.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 3]: /images/20220120/19808d416f1c4a989b50d8b5d18b05e5.png
[20190610144241567.png]: /images/20220120/51d77ca8fc1b4c8ab028530b3b527f41.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 4]: /images/20220120/fce66b1c54c34c17ac946f89147f5899.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 5]: /images/20220120/df6934723d164f13beab0b1df3ccb875.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 6]: /images/20220120/1dfa31ae25494910bd4928a87900a209.png
[https_download.csdn.net_download_huanongying131_11233693]: https://download.csdn.net/download/huanongying131/11233693