Say you open an image file (.sys file) as windbg -z imageFile as Doron had
pointed out in one of this earlier posts. Now you disassemble this and do
whatever. How do I save these changes now? Seems to me that any changes I do
to the image are not saved.
banks
As far as I know, you can’t save the changes to the image. The debugger
is not an image editor, it just matches the image with the symbols and
let’s you symbolically see what has been built.
d
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of bank kus
Sent: Monday, July 17, 2006 5:29 PM
To: Kernel Debugging Interest List
Subject: [windbg] save results of winbg -z imagefile
Say you open an image file (.sys file) as windbg -z imageFile as Doron
had
pointed out in one of this earlier posts. Now you disassemble this and
do
whatever. How do I save these changes now? Seems to me that any changes
I do
to the image are not saved.
banks
You are currently subscribed to windbg as: xxxxx@microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
So when you open a dump file (image file) this way and disassemble a
function, the function shows an address. What is this address? is it a RVA
or an address post some pseudo load-relocation operation, how does it work?
Or is this just a better dumpbin.
“Doron Holan” wrote in message
news:xxxxx@windbg…
As far as I know, you can’t save the changes to the image. The debugger
is not an image editor, it just matches the image with the symbols and
let’s you symbolically see what has been built.
d
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of bank kus
Sent: Monday, July 17, 2006 5:29 PM
To: Kernel Debugging Interest List
Subject: [windbg] save results of winbg -z imagefile
Say you open an image file (.sys file) as windbg -z imageFile as Doron
had
pointed out in one of this earlier posts. Now you disassemble this and
do
whatever. How do I save these changes now? Seems to me that any changes
I do
to the image are not saved.
banks
—
You are currently subscribed to windbg as: xxxxx@microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
It is relative to the preferred image base of the module as I recall.
–
Ken Johnson (Skywing)
Windows SDK MVP
“bank kus” wrote in message news:xxxxx@windbg…
> So when you open a dump file (image file) this way and disassemble a
> function, the function shows an address. What is this address? is it a RVA
> or an address post some pseudo load-relocation operation, how does it
> work? Or is this just a better dumpbin.
>
>
> “Doron Holan” wrote in message
> news:xxxxx@windbg…
> As far as I know, you can’t save the changes to the image. The debugger
> is not an image editor, it just matches the image with the symbols and
> let’s you symbolically see what has been built.
>
> d
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of bank kus
> Sent: Monday, July 17, 2006 5:29 PM
> To: Kernel Debugging Interest List
> Subject: [windbg] save results of winbg -z imagefile
>
> Say you open an image file (.sys file) as windbg -z imageFile as Doron
> had
> pointed out in one of this earlier posts. Now you disassemble this and
> do
> whatever. How do I save these changes now? Seems to me that any changes
> I do
> to the image are not saved.
>
> banks
>
>
>
> —
> You are currently subscribed to windbg as: xxxxx@microsoft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>