Windbg 反汇编命令u/uf

反汇编指令u，uf
对指令的地址进行反汇编或对某一个函数进行反汇编

u @$exentry L10

L10表示控制显示0x10行反汇编，即16行

0:001> u @$exentry L10
notepad!WinMainCRTStartup:
01006420 55               push    ebp
01006421 8bec             mov     ebp,esp
01006423 6aff             push    0xff
01006425 6888180001       push    0x1001888
0100642a 68d0650001       push    0x10065d0
0100642f 64a100000000     mov     eax,fs:[00000000]
01006435 50               push    eax
01006436 64892500000000   mov     fs:[00000000],esp
0100643d 83c498           add     esp,0xffffff98
01006440 53               push    ebx
01006441 56               push    esi
01006442 57               push    edi
01006443 8965e8           mov     [ebp-0x18],esp
01006446 c745fc00000000   mov     dword ptr [ebp-0x4],0x0
0100644d 6a02             push    0x2
0100644f ff1560110001 call dword ptr [notepad!_imp____set_app_type (01001160)]
    uf (Unassemble Function)指令对整个函数进行反汇编

uf GetLanguageCount

0:000> uf GetLanguageCount
DGGuarder!GetLanguageCount [j:mydriverdgguarder2language.c @ 54]:
   54 00403c00 55               push    ebp
   54 00403c01 8bec             mov     ebp,esp
   54 00403c03 81ecc0000000     sub     esp,0xc0
   54 00403c09 53               push    ebx
   54 00403c0a 56               push    esi
   54 00403c0b 57               push    edi
   54 00403c0c 8dbd40ffffff     lea     edi,[ebp-0xc0]
   54 00403c12 b930000000       mov     ecx,0x30
   54 00403c17 b8cccccccc       mov     eax,0xcccccccc
   54 00403c1c f3ab             rep     stosd
   56 00403c1e 6a00             push    0x0
   56 00403c20 6828b44100       push    0x41b428
   56 00403c25 6820b44100       push    0x41b420
   56 00403c2a e8b1edffff       call    DGGuarder!ReadInt (004029e0)
   56 00403c2f 83c40c           add     esp,0xc
   58 00403c32 5f               pop     edi
   58 00403c33 5e               pop     esi
   58 00403c34 5b               pop     ebx
   58 00403c35 81c4c0000000     add     esp,0xc0
   58 00403c3b 3bec             cmp     ebp,esp
   58 00403c3d e85e0f0000       call    DGGuarder!_RTC_CheckEsp (00404ba0)
   58 00403c42 8be5             mov     esp,ebp
   58 00403c44 5d               pop     ebp
   58 00403c45 c3               ret