PROJECT: updated help
This commit is contained in:
parent
b7b27adff5
commit
a8f70ccc01
|
|
@ -6,9 +6,9 @@
|
|||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
||||
<style>
|
||||
html,body {
|
||||
/* Default Font */
|
||||
font-family: Courier New;
|
||||
font-size: 11pt;
|
||||
/* Default Font */
|
||||
font-family: Courier New;
|
||||
font-size: 11pt;
|
||||
}
|
||||
</style>
|
||||
|
||||
|
|
@ -19,34 +19,52 @@ html,body {
|
|||
operations, just type an expression in the
|
||||
command window and the result will be displayed in the console. Apart from
|
||||
calculations, it allows quick variable changes using a C-like syntax.</P>
|
||||
<P><STRONG>Operators</STRONG><BR> You can use the
|
||||
following operators in your expression. They are processed in the following order:</P>
|
||||
<P><U>0:negative</U>
|
||||
: Negative numbers can be prefixed by a
|
||||
'-' sign.</P>
|
||||
<P><U>1:</U><U>brackets</U>: '(' and ')' Brackets are
|
||||
resolved first, there is no need for a terminating bracket, unless you want to
|
||||
use one.</P>
|
||||
<P><U>2:not</U>: '~' The not operator can be used before a
|
||||
number of a variable, like in C.</P>
|
||||
<P><U>3:muliplication/devision</U>: '*' = regular
|
||||
multiplication (signed/unsigned), '`' = get the higher part of the
|
||||
multiplication, '/' = regular devision (signed/unsigned, devide by zero=error)
|
||||
and '%' = get the modulo (remainder) of the devision.</P>
|
||||
<P><U>4:addition/substraction</U>: '+' and '-'</P>
|
||||
<P><U>5:shift</U>: '<' = shift left (shl for unsigned,
|
||||
sal for signed), '>' = shift right (shr for unsigned, sar for signed).</P>
|
||||
<P><U>6:and</U>: '&' Just the regular AND operation like
|
||||
in C.</P>
|
||||
<P><U>7:xor</U>: '^' Just the regular XOR operation like in
|
||||
C.</P>
|
||||
<P><U>8:or</U>: '|' Just the regular OR operation like in
|
||||
C.</P>
|
||||
<P><STRONG>Quick-Assigning<BR></STRONG>Changing memory, a
|
||||
<P><STRONG>Operators</STRONG><BR> You can use the following operators in your expression.
|
||||
They are processed in the following order (<A
|
||||
href="http://en.cppreference.com/w/c/language/operator_precedence"
|
||||
target=_blank>source</A>):</P>
|
||||
<P><U>1:parentheses/brackets</U>: <EM>(1+2)</EM>, [1+6] have
|
||||
priority over other operations.</P>
|
||||
<P><U>2:unary minus/binary not/logical not</U>: <EM>-1</EM> (negative 1), <EM>~1</EM> (binary not of 1), <EM>!0</EM>
|
||||
(logical not of 0).</P>
|
||||
<P><U>
|
||||
3:multiplication/division</U>:
|
||||
<EM>2*3</EM> (regular multiplication), <EM>2`3</EM> (gets high part of the
|
||||
multiplication), 6/3 (regular division), <EM>5%3</EM> (modulo/remainder of
|
||||
the division).</P>
|
||||
<P><U>4:addition/subtraction</U>:
|
||||
<EM>1+3</EM> (addition), <EM>5-2</EM>
|
||||
(subtraction).</P>
|
||||
<P><U>5:left/right
|
||||
shift</U>: <EM>1<<2</EM> (shift left, shl for unsigned, sal for
|
||||
signed), <EM>10>>1</EM> (shift right, shl
|
||||
for unsigned, sal for signed). </P>
|
||||
<P><U>6:smaller (equal)/bigger (equal)</U>: 4<10, 3>6,
|
||||
<EM>1<=2</EM>, <EM>6>=7</EM> (resolves to 1 if true,
|
||||
0 if false).</P>
|
||||
<P><U>7:equal/not equal</U>: <EM>1==1</EM>, <EM>2!=6</EM>
|
||||
(resolves to 1 if true, 0 if
|
||||
false).</P>
|
||||
<P><U>8:binary and</U>: <EM>12&2</EM>
|
||||
(regular binary
|
||||
and).</P>
|
||||
<P><U>9:binary xor</U>: <EM>2^1</EM>
|
||||
(regular binary
|
||||
xor).</P>
|
||||
<P><U>10:binary or</U>: <EM>2|8</EM>
|
||||
(regular binary
|
||||
or).</P>
|
||||
<P><U>11:logical and</U>: <EM>0&&3</EM>
|
||||
(resolves to 1 if true, 0 if
|
||||
false).</P>
|
||||
<P><U>12:logical or</U>: <EM>0||3</EM>
|
||||
(resolves to 1 if true, 0 if
|
||||
false).</P>
|
||||
<P><STRONG><U>Quick-Assigning<BR></U></STRONG>Changing memory, a
|
||||
variable, register or flag can be easily done using a C-like
|
||||
syntax:</P>
|
||||
<P><U>a?=b</U>: '?' can be any mathematical operation. 'a'
|
||||
can be any register, flag, variable or memory location. 'b' can be anything that is recognized as a mathmatical
|
||||
input.</P>
|
||||
<P><U>a++/a--</U>: 'a' can be any register, flag, variable or memory
|
||||
<P>a?= b: '?' can be any non-logical operator.
|
||||
'a' can be any register, flag, variable or memory location. 'b' can be anything that is recognized as an
|
||||
expression.</P>
|
||||
<P>a++/a--: 'a' can be any register, flag, variable or memory
|
||||
location.</P></body>
|
||||
|
|
@ -20,7 +20,7 @@ the executable (do some basic checks), set breakpoints on TLS callbacks
|
|||
(if present), set a breakpoint at the process entry point and
|
||||
break at the system breakpoint before giving back control to the
|
||||
user.</P>
|
||||
<P><U>arguments</U><BR> arg1 : Path to the executable file to debug. If no full path is given, the GetCurrentDirectory API will be
|
||||
<P><U>arguments</U><BR> arg1: Path to the executable file to debug. If no full path is given, the GetCurrentDirectory API will be
|
||||
called to retrieve a full path. Use quotation marks to include spaces in your path.
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -25,26 +25,25 @@ Variables optionally start with a $ and can only store one DWORD (QWORD on
|
|||
x64).</P>
|
||||
<P class=rvps3><U> registers</U>: All
|
||||
registers (of all sizes) can be used as variables.</P>
|
||||
<P class=rvps3><U>memory locations</U>: You can read from a memory location by using one of the
|
||||
following expressions:<BR>[addr] - read a
|
||||
<P class=rvps3><U>memory locations</U>:
|
||||
You can read/write from/to a memory location by using one of the
|
||||
following expressions:<BR>[addr] - read a
|
||||
DWORD/QWORD, depending on the
|
||||
architecture.<BR><EM>n</EM>:[addr] - read <EM>n</EM> bytes
|
||||
from.<BR><STRONG>REMARKS</STRONG>:<BR>- <EM>n</EM> is the amount of bytes to read, this can be anything
|
||||
smaller than 4 on x32 and smaller than 8 on x64 when specified, otherwise
|
||||
|
||||
|
||||
|
||||
|
||||
there will be an error.</P>
|
||||
<P class=rvps3><U>flags</U>: Debug
|
||||
flags (interpreted as integer) can be used as input. Flags are prefixed with a
|
||||
'!' following the flag name. Valid flags are: !cf, !pf, !af, !zf, !sf, !tf, !if,
|
||||
!df, !of, !rf, !vm, !ac, !vif, !vip and !id.</P>
|
||||
architecture.<BR><EM>n</EM>:[addr] - read <EM>n</EM> bytes from.<BR><EM>seg</EM>:[addr] -
|
||||
read a DWORD/QWORD from a
|
||||
segment.<BR><STRONG>REMARKS</STRONG>:<BR>- <EM>n</EM> is the amount of bytes to read, this can be anything
|
||||
smaller than 4 on x32 and smaller than 8 on x64 when specified, otherwise there
|
||||
will be an error.<BR>- <EM>seg</EM>
|
||||
can be gs, es, cs, fs, ds, ss. Only fs and gs have an effect.</P>
|
||||
<P class=rvps3><U>flags</U>: Debug flags
|
||||
(interpreted as integer) can be used as input. Flags are prefixed with an '_'
|
||||
followed by the flag name. Valid flags are: _cf, _pf, _af, _zf, _sf, _tf, _if,
|
||||
_df, _of, _rf, _vm, _ac, _vif, _vip and _id.</P>
|
||||
<P class=rvps3><U>numbers</U>: All
|
||||
numbers are interpreted as hex by default. If you want to be sure, you can use
|
||||
the "x" prefix or the "0x" prefix. Decimal numbers can be used by prefixing the
|
||||
number with a "." (.123=7B).</P>
|
||||
<P class=rvps3><U>basic calculations</U>: See "Calculations" for more information.</P>
|
||||
<P class=rvps3><U> expressions</U>: See "Expressions" for more information.</P>
|
||||
<P class=rvps3><U>Module Data</U>:</P>
|
||||
<OL>
|
||||
<LI>
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ that can react on the flags set by the 'cmp' (and maybe
|
|||
other) command(s):</P>
|
||||
<UL>
|
||||
<LI>
|
||||
<DIV>uncondentional branch -
|
||||
<DIV>unconditional branch -
|
||||
<U>jmp/goto</U></DIV>
|
||||
<DIV></DIV>
|
||||
<LI>
|
||||
|
|
|
|||
|
|
@ -15,10 +15,10 @@ html,body {
|
|||
</head>
|
||||
|
||||
<body>
|
||||
<P><STRONG>cmp<BR></STRONG>This command compares two expressions. Notice that
|
||||
when you want to check for values being bigger or smaller, the comparison
|
||||
arg1>arg2 is made. If this evaluates to true, the $_BS_FLAG is set to 1,
|
||||
meaning the value is internally bigger. So you test if arg1 is bigger/smaller than
|
||||
<P><STRONG>cmp<BR></STRONG> This command compares two expressions. Notice
|
||||
that when you want to check for values being bigger or smaller, the
|
||||
comparison arg1>arg2 is made. If this evaluates to true, the $_BS_FLAG is set to
|
||||
1, meaning the value is bigger. So you test if arg1 is bigger/smaller than
|
||||
arg2.</P>
|
||||
<P><U>arguments<BR></U> arg1: First expression to compare.
|
||||
</P>
|
||||
|
|
|
|||
|
|
@ -0,0 +1,33 @@
|
|||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
<title>functionclear</title>
|
||||
<meta name="GENERATOR" content="WinCHM">
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
||||
<style>
|
||||
html,body {
|
||||
/* Default Font */
|
||||
font-family: Courier New;
|
||||
font-size: 11pt;
|
||||
}
|
||||
</style>
|
||||
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<P>
|
||||
<STRONG>
|
||||
functionclear
|
||||
<BR>
|
||||
|
||||
</STRONG>Delete all functions in all modules.
|
||||
</P>
|
||||
<P >
|
||||
<U >
|
||||
arguments</U>
|
||||
|
||||
<BR>
|
||||
This command has no arguments.</P>
|
||||
<P><U>result<BR></U> This command does not
|
||||
set any result variables.</P></body>
|
||||
</html>
|
||||
12
help/log.htm
12
help/log.htm
|
|
@ -19,12 +19,12 @@ html,body {
|
|||
<P><U>arguments</U><BR>[arg1]: Format string (see down for
|
||||
more information). When not specified, a newline will be logged.</P>
|
||||
<P>[argN]: Data for the format string.</P>
|
||||
<P><U>format string</U><BR>A format string like "Info 1:
|
||||
{0}, Info 2: {1}\n Info 3:{2}". In place of {n} the n-th argument after the
|
||||
format string is inserted. You can specify how to format the inserted data by
|
||||
prepending a format type: "{s0}" logs a string. Other types are: "d" (log as
|
||||
signed decimal), "u" (log as unsigned decimal), "p" (log as 0x????????), "s"
|
||||
(log the string at the address specified).<BR>You can print a "{" by escaping it
|
||||
<P><U>format string</U><BR>
|
||||
A format string like "Info 1: {0}, Info 2: {1}\n Info 3:{2}". In
|
||||
place of {n} the n-th argument after the format string is inserted. You can
|
||||
specify how to format the inserted data by prepending a format type: "{s:0}" logs
|
||||
a string. Other types are: "d" (log as signed decimal), "u" (log
|
||||
as unsigned decimal), "p" (log as ????????).<BR>You can print a "{" by escaping it
|
||||
like "{{". Same for "{". "\n" inserts a newline.</P>
|
||||
<P><U>result</U><BR>This command does not set any result
|
||||
variables.</P></body>
|
||||
|
|
|
|||
|
|
@ -20,6 +20,6 @@ value.</P>
|
|||
<P class=rvps3><U>arguments </U><BR> arg1: Value to test.</P>
|
||||
<P class=rvps3> arg2: Tester.</P>
|
||||
<P class=rvps3><U>result<BR></U>This command sets the internal variables $_EZ_FLAG
|
||||
and $_BS_FLAG. $_EZ_FLAG is set to 1 when arg1&arg2= = 0. $_BS_FLAG is
|
||||
and $_BS_FLAG. $_EZ_FLAG is set to 1 when arg1 & arg2 == 0. $_BS_FLAG is
|
||||
always set to 0.</P></body>
|
||||
</html>
|
||||
BIN
help/x64_dbg.wcp
BIN
help/x64_dbg.wcp
Binary file not shown.
|
|
@ -88,9 +88,12 @@ static void registercommands()
|
|||
dbgcmdnew("eSingleStep\1esstep\1esst", cbDebugeSingleStep, true); //SingleStep arg1:count + skip first chance exceptions
|
||||
dbgcmdnew("StepOut\1rtr", cbDebugRtr, true); //rtr
|
||||
dbgcmdnew("eStepOut\1ertr", cbDebugeRtr, true); //rtr + skip first chance exceptions
|
||||
|
||||
dbgcmdnew("DebugContinue\1con", cbDebugContinue, true); //set continue status
|
||||
|
||||
dbgcmdnew("LibrarianSetBreakPoint\1bpdll", cbDebugBpDll, true); //set dll breakpoint
|
||||
dbgcmdnew("LibrarianRemoveBreakPoint\1bcdll", cbDebugBcDll, true); //remove dll breakpoint
|
||||
|
||||
dbgcmdnew("switchthread\1threadswitch", cbDebugSwitchthread, true); //switch thread
|
||||
dbgcmdnew("suspendthread\1threadsuspend", cbDebugSuspendthread, true); //suspend thread
|
||||
dbgcmdnew("resumethread\1threadresume", cbDebugResumethread, true); //resume thread
|
||||
|
|
@ -98,16 +101,19 @@ static void registercommands()
|
|||
dbgcmdnew("suspendallthreads\1threadsuspendall", cbDebugSuspendAllThreads, true); //suspend all threads
|
||||
dbgcmdnew("resumeallthreads\1threadresumeall", cbDebugResumeAllThreads, true); //resume all threads
|
||||
dbgcmdnew("setthreadpriority\1setprioritythread\1threadsetpriority", cbDebugSetPriority, true); //set thread priority
|
||||
|
||||
dbgcmdnew("symdownload\1downloadsym", cbDebugDownloadSymbol, true); //download symbols
|
||||
|
||||
dbgcmdnew("setjit\1jitset", cbDebugSetJIT, false); //set JIT
|
||||
dbgcmdnew("getjit\1jitget", cbDebugGetJIT, false); //get JIT
|
||||
dbgcmdnew("getjitauto\1jitgetauto", cbDebugGetJITAuto, false); //get JIT Auto
|
||||
dbgcmdnew("setjitauto\1jitsetauto", cbDebugSetJITAuto, false); //set JIT Auto
|
||||
|
||||
dbgcmdnew("getcmdline\1getcommandline", cbDebugGetCmdline, true); //Get CmdLine
|
||||
dbgcmdnew("setcmdline\1setcommandline", cbDebugSetCmdline, true); //Set CmdLine
|
||||
|
||||
dbgcmdnew("loadlib", cbDebugLoadLib, true); //Load DLL
|
||||
dbgcmdnew("skip", cbDebugSkip, true); //skip one instruction
|
||||
dbgcmdnew("setfreezestack", cbDebugSetfreezestack, false); //freeze the stack from auto updates
|
||||
|
||||
//breakpoints
|
||||
dbgcmdnew("bplist", cbDebugBplist, true); //breakpoint list
|
||||
|
|
@ -172,6 +178,7 @@ static void registercommands()
|
|||
dbgcmdnew("refadd", cbInstrRefadd, false);
|
||||
dbgcmdnew("asm", cbInstrAssemble, true); //assemble instruction
|
||||
dbgcmdnew("sleep", cbInstrSleep, false); //Sleep
|
||||
dbgcmdnew("setfreezestack", cbDebugSetfreezestack, false); //freeze the stack from auto updates
|
||||
|
||||
//user database
|
||||
dbgcmdnew("cmt\1cmtset\1commentset", cbInstrCmt, true); //set/edit comment
|
||||
|
|
@ -188,6 +195,7 @@ static void registercommands()
|
|||
dbgcmdnew("labellist", cbInstrLabelList, true); //list labels
|
||||
dbgcmdnew("bookmarklist", cbInstrBookmarkList, true); //list bookmarks
|
||||
dbgcmdnew("functionlist", cbInstrFunctionList, true); //list functions
|
||||
dbgcmdnew("functionclear", cbInstrFunctionClear, false); //delete all functions
|
||||
|
||||
//memory operations
|
||||
dbgcmdnew("alloc", cbDebugAlloc, true); //allocate memory
|
||||
|
|
@ -257,7 +265,6 @@ static void registercommands()
|
|||
dbgcmdnew("setmaxfindresult\1findsetmaxresult", cbInstrSetMaxFindResult, false); //set the maximum number of occurences found
|
||||
dbgcmdnew("savedata", cbInstrSavedata, true); //save data to disk
|
||||
dbgcmdnew("scriptdll\1dllscript", cbScriptDll, false); //execute a script DLL
|
||||
dbgcmdnew("functionclear", cbInstrFunctionClear, false); //delete all functions
|
||||
}
|
||||
|
||||
static bool cbCommandProvider(char* cmd, int maxlen)
|
||||
|
|
|
|||
Loading…
Reference in New Issue