Windbg

windbg lmvm命令

2023-12-20 14 0

lmvm命令可以查看加载的模块的信息。
如我们在调试某个进程时，可以通过该命令查看该进程的模块地址：

0:009> lmvm "wecam"
Browse full module list
start             end                 module name
00007ff6`07ad0000 00007ff6`07d94000   WeCam      (export symbols)       C:\Program Files\e2eSoft\WeCam\WeCam.exe
    Loaded symbol image file: C:\Program Files\mySoft\WeCam\WeCam.exe
    Image path: WeCam.exe
    Image name: WeCam.exe
    Browse all global symbols  functions  data
    Timestamp:        Tue Jul  2 16:46:37 2024 (6683BE6D)
    CheckSum:         002B3131
    ImageSize:        002C4000
    File version:     2.4.2.2678
    Product version:  2.4.2.2678
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0400.04b0
    Information from resource tables:

可以看到，其基地址为：00007ff6`07ad0000
那么我们可以通过IDA修正进程的加载地址：
110956438949
111019881898