Debug in Windows
1. Afterwards, there are two most basic goals: (1) Discovery is where crash (2) find out the cause of the program crash 2. Debugging technology is selected as the order of order: (1) Use the debug version Local debug (2) Take local debugging (3) using debug symbols (3) Use debug version to remote debugging (4) using a release version with debug symbols (5) After using the Dr.Watson log file Debug (6) Using the information of the crash dialog to debug 3. Return the value of the type BOOL type Windows API function is not necessarily 0 or 1, so when writing the C program with debugging, the return value is returned True is a more risky thing to avoid this. Returns the Windows API function of the type of Handle When there is an error, an empty handle is usually returned, or returns INVALID_HANDLE_VALUE (value -1). Returning the Windows API function of the type Long or DWORD, usually returns 0 or -1. If an API function is impossible to have an error, it returns Void. The corresponding error code can be obtained by getLastError. 4. In Visual C , by entering "@err, hr" in the viewing window, you can monitor the return value of getLastError. 5. If you want to display an error code in the error message, you can convert the error code to the text format through the FormatMessage API function. 6. Never relocate third-party DLL7 that other programs will be used. Optimization versions usually do not use EBP as a stack base pointer. This type of optimization is called frame pointer omit (FPO) 8. Because the optimized version may not use the stack base pointer, if the function prototype declares inconsistent, it is likely that the function will be collapsed when the function returns. 9. Use the debug anti-assembly window to view your source code to be converted into assembly code 10. Create the most useful mapping file, usually use / mapInfo: Lines, and / mapInfo: Exports project options. Archive the mapping file of all the modules of the program you publish. 11. Use the Visual C Name Analytical Tool (undname) to convert the mixed name to the original name. Undname? Randomexception @@ ygxhhhh @ z
Output:? Randomexception @@ ygxhhhh @ z == randomexception
-f option Shows the entire function prototype undname -f? randomexception @@ ygxhhhh @ z
Output:? Randomexception @@ ygxhhhh @ z == void __stdcall randomexception11. The runtime runtime function library is tracked for memory allocation and allows the user to check the memory leak; write 0xcd byte mode in the just allocated memory This helps to find errors that are not initialized; write 0xcd byte mode in the released memory, which helps find four bytes using have been released; four-byte in both sides of the buffer Protection data, and use 0xFD byte mode to check to check the overflow and underflow of write memory; record the source code file name and line number in each memory allocation, which helps users in source code Memory allocation is positioned. Therefore, the debug version can find a variety of memory errors. 12. Frame pointer omission (FPO) hides errors that the function prototype does not match, which only causes crash when the function is returned in the debug version. 13. All variables in debug versions are Volatile. And if a variable is not set to volatile, there will be an optimized error. If you multi-thread, the probability of the program is very large. 15. Variable Optimization Problem in Publishing: Void Stackattack () {Int OptimizedOut1, Optimizedout2; Tchar Bugstext [16], * BUGS = _T ("this function HAS BUGS!"); _Tcscpy (bugstext, bus);} in this In the function, the length of the BUGSTEXT buffer cannot receive the bugs string. Unnecessary variables Optimizedout1 and OptimizedOut2 protect the stack content in the debug version is not damaged, but these variables will be removed in the release version. The result is that the overflow of the buffer will destroy the stack's function returns the address, so that the published program will crash, and will not be in the debug version. General, optimized variables will not be so obvious. 12. It is best to create a debug symbol for your executable, and the PDB document archive will be filed even if the program belongs to the release. 13. Create a debug symbol for a version of the program to do the following settings for the Visual C items corresponding to the program: (1) Open the engineering settings dialog box, select the desired version in the Setting ... dialog box (such as : Win32 Release). (2) Select the entire project by clicking the root node in the engineering control tree. (3) Select the general class in the C / C tag. In debugging, if you are a release version, select Program Database if it is a debug version, select Program Database for Edit and Continue (Note: Editing Continue options are incompatible, and it also increases the length of the executable file, This is not suitable for publishing versions). (4) Select the Debug class in the LINK tag. Then select Debug Info and Microsoft Format options. Remember not to select the Separate Types option, so all debug information will be merged into a separate PDB file. Also, if you need to debug a mapping file after you, remember to select the Generate MapFile option. (5) For the release version, select the LINK tab, and add "/ OPT: REF" in the Project Options dialog. This option makes the functions and data that are not referenced from the executable, thereby avoiding the increase in file fearlessness.
Do not use this option for the debug version because it closes the incremental link (6) to recompile the entire project with the Rebuild All command. Note: If you find the executable of the debug symbol than the executable file that does not tune the trial, it is very likely that you forget to add / opt: REF link options. 14. In order to further control debugging, use the anti-assembly code window to debug 15. It is best not to use the Separate Types option unless you have a very large engineering on a very slow computer. 16. You can display the Tib (Thread Information Block structure in the observation window, using @Tib, and add the following code in the program: #ifdef _debug #include "Tib.h" PTIB PTIB #ENDIF in the viewing window via PTIB = @ @@ @ 口TIB to view TIB content. 17. Using autoexp.dat18. Setting the system call breakpoint in Windows2000: (1) Determine the module containing the API function. FindStr MessageBox Win32API.CSV (2) Determines the debug symbols corresponding to the module (3) Determine the true function name dumpbin -symbols user32.dbg | FINDSTR MessageBox Returns "_MessageBoxa @ 16". If the debug symbol is not loaded, use the command: dumpbin -exports user32.dll | FINDSTR MessageBox Returns "MessageBox", note that "MessageBox" will only be seen by the preprocessor, it converts the name to "MessageBoxa" or "MessageBoxwww "," A "represents ANSI, and" W "represents wide character or unicode. (4) Set the breakpoint in the breakpoint dialog. If the debug symbol is loaded, enter {,, usr32.dll} _MessageBoxa @ 16 If debug symbol is not loaded, enter {, User32.dll} MessageBoxa If debug symbol is not loaded, you also need to DEBUG in the options dialog Set the Load Coff & Export option in the tag. This option allows you to set breakpoints on the output function without debug symbols. Note: If there is no FindStr.exe tool, you can use the Visual C 's FINDILES command. 19. If the return value is not more than 32 bits, you can type "@EAX" in the observation window. If the return value is 64 bits, the low 32 is placed in Eax, and the high 32 bits are placed in EDX. If the return value is greater than 64 bits, the pointer to the return value will be placed in EAX, which can be used to convert in the observation window, for example, if a CRECT is returned, "can be typed" (CRECT *) @ eax "display result, Or directly in the Address column of the memory window to view the return value. 20. Use the API function getasynckeyState to help you debug the WM_MOUSEMOVE message. 21. Use Spy debugging with messages. 22. Using the callback to help you debug Windows code: Tune allows you to enter Windows to see what it is doing. 23.PostMessage and SendMessage Difference: PostMessage is only responsible for placing messages into the message queue, is not sure when and whether SendMessage wants to wait until the return code (DWORD type) is subject to message processing (DWORD type), you can use the x86 memory alignment Rules to determine if a pointer is valid.
