如何在 C++ 符号上设置断点?

逆向工程 调试 C++ 风袋
2021-07-10 07:48:59

如何在这个 C++ 符号上设置断点?

bp qmgr!TokenHandle::operator-: 无法解决“qmgr!TokenHandle::operator-:”错误

在windbg?

2个回答

确保您的符号正确
无法解析意味着符号不存在
首先确认 x /f /v(f 仅显示函数,v 显示详细信息)
接下来使用调试器吐出的建议在符号上设置断点
大多数内联函数需要 bm 断点
或 bu 断点

内联或重载函数(模糊函数)上的 bp 断点可能会失败

0:000> x /f /v calc!*CSc*::*=*
pub func   00ad4248             0 calc!CScientificKeypad::operator= (<no parameter info>)

0:000> x /1 calc!*CSc*::*=*
calc!CScientificKeypad::operator=

0:000> bp calc!CScientificKeypad::operator=

Couldn't resolve error at 'calc!CScientificKeypad::operator='
The breakpoint expression "calc!CScientificKeypad::operator=" evaluates to the inline function.

Please use bm command to set breakpoints instead of bp.

0:000> bu calc!CScientificKeypad::operator=
Couldn't resolve error at 'calc!CScientificKeypad::operator='
The breakpoint expression "calc!CScientificKeypad::operator=" evaluates to the inline function.
Please use bm command to set breakpoints instead of bu.

0:000> bm calc!CScientificKeypad::operator=
  1: 00ad4248          @!"calc!CScientificKeypad::operator="

0:000> bl
 1 e 00ad4248     0001 (0001)  0:**** calc!CScientificKeypad::operator=
0:000> g

Breakpoint 1 hit

calc!CScientificKeypad::operator=:
00ad4248 8bff            mov     edi,edi

0:000> kb
 # ChildEBP RetAddr  Args to Child              
00 0015e7fc 00ad41eb 00b043c8 2b3b2a3d 761ef2a9 calc!CScientificKeypad::operator=
01 0015e828 00ad3fe7 00b0433c 00b043c8 000000aa calc!CScientificMode::CScientificMode+0x49
02 0015e878 00ad3e69 00000000 762025df 00b04210 calc!CContainer::LayoutScientificMode+0x93
03 0015f0fc 00ab1b0e 00000000 00b04a68 0025264c calc!CContainer::AssembleDialogsWithoutToolset+0x18e
04 0015fe6c 00ac219a 00ab0000 00000000 0025264c calc!WinMain+0x581
05 0015fefc 77883c45 7ffdf000 0015ff48 77d537f5 calc!_initterm_e+0x1a1
06 0015ff08 77d537f5 7ffdf000 77c5ad65 00000000 kernel32!BaseThreadInitThunk+0xe
07 0015ff48 77d537c8 00ac2d6c 7ffdf000 00000000 ntdll!__RtlUserThreadStart+0x70
08 0015ff60 00000000 00ac2d6c 7ffdf000 00000000 ntdll!_RtlUserThreadStart+0x1b

它看起来像你必须在你的字符串(结束一个额外的冒号operator-:),你可能需要使用bm代替bp

class TokenHandle
{
public:
    int data;
    TokenHandle(int i) 
    {
        data = i;
    }
    TokenHandle operator-(TokenHandle& in)
    {
        return TokenHandle(data - in.data);
    }
};

WinDbg:

0:000> bm test!TokenHandle::operator-
  1: 00000001`3fd62da0 @!"test!TokenHandle::operator-"

或者验证调试器是否能够找到正确的符号(并且您始终可以在找到的地址上设置断点):

0:000> x test!TokenHandle*
00000001`3fd62da0 test!TokenHandle::operator- (class TokenHandle *)
00000001`3fd626c0 test!TokenHandle::TokenHandle (int)
0:000> bp 00000001`3fd62da0