Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #8  
Old 04-29-2006, 19:01
MarkusO
 
Posts: n/a
It seems like I'm a bit too stupid to use LiveKD. I did the following:
  • Download and install the Windows 32-bit debugging tools
  • Download LiveKD and copy it into the debugging tools folder.
  • Configure the symbol path in WinDBG.
  • Start LiveKD by running File->Kernel Debug->Local
  • Open register, memory and disassembly windows from the menu
Then I had a command line (perfix: "lkd>") where I could enter my commands. I called "?" to list me the available commands

First I tried to show what's located at "fs:[124]" by entering "d fs:124", but I only got the message "GetContextState failed, 0x80004001" three times followed by "bad segment error at '124'.

Next I only entered "d 124" and got a memory dump, but only filled with "??" as data.

After that I read the help file entry for the "d" command to learn all possible "dump" commands and their correct syntax, but none of them worked, even the dump commands for psysical memory failed.

So how should I read "fs:[124]" from Ring-0 with WinDBG?
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 21:11.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )