询问者
关于NTSD命令WT

问题
-
CMD/NTSD 下WT命令结果很长,想存成一个TXT文件,有没有办法?
Microsoft (R) Windows User-Mode Debugger Version 5.1.2600.0
Copyright (c) Microsoft Corporation. All rights reserved.CommandLine: ping
Loaded dbghelp extension DLL
The call to LoadLibrary(ext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded exts extension DLL
The call to LoadLibrary(uext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded ntsdexts extension DLL
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
ModLoad: 01000000 01008000 ping.exe
ModLoad: 7c920000 7c9b6000 ntdll.dll
ModLoad: 7c800000 7c91e000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77be0000 77c38000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77da0000 77e49000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e50000 77ee2000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77fc0000 77fd1000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 76d30000 76d48000 C:\WINDOWS\system32\iphlpapi.dll
ModLoad: 77d10000 77da0000 C:\WINDOWS\system32\USER32.dll
ModLoad: 77ef0000 77f39000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 71a20000 71a37000 C:\WINDOWS\system32\WS2_32.dll
ModLoad: 71a10000 71a18000 C:\WINDOWS\system32\WS2HELP.dll
Break instruction exception - code 80000003 (first chance)
eax=00191eb4 ebx=7ffd6000 ecx=00000002 edx=00000004 esi=00191f48 edi=00191eb4
eip=7c92120e esp=0007fb20 ebp=0007fc94 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdl
l.dll -
ntdll!DbgBreakPoint:
7c92120e cc int 3
0:000> wt
Tracing ntdll!DbgBreakPoint to return address 7c940b1f
6 0 [ 0] ntdll!RtlDeleteAce
4 0 [ 0] ntdll!RtlLookupElementGenericTable
13 0 [ 1] ntdll!RtlPushFrame
9 0 [ 2] ntdll!RtlImageDirectoryEntryToData
3 0 [ 3] ntdll!RtlAllocateHeap
*** ERROR: Module load completed but symbols could not be loaded for ping.exe
19 0 [ 4] ntdll!strchr
21 19 [ 3] ntdll!RtlAllocateHeap
9 0 [ 4] ntdll!strchr
22 28 [ 3] ntdll!RtlAllocateHeap
20 50 [ 2] ntdll!RtlImageDirectoryEntryToData
21 0 [ 3] ntdll!RtlImageDirectoryEntryToData
23 71 [ 2] ntdll!RtlImageDirectoryEntryToData
79 94 [ 1] ntdll!RtlPushFrame
18 173 [ 0] ntdll!RtlLookupElementGenericTable
10 0 [ 1] ntdll!RtlNtPathNameToDosPathName
31 0 [ 2] ntdll!RtlInitUnicodeString
19 31 [ 1] ntdll!RtlNtPathNameToDosPathName
3 0 [ 2] ntdll!LdrLoadDll
19 0 [ 3] ntdll!strchr
152 19 [ 2] ntdll!LdrLoadDll
12 0 [ 2] ntdll!RtlValidateUnicodeString
44 0 [ 3] ntdll!memmove
28 44 [ 2] ntdll!RtlValidateUnicodeString
31 0 [ 3] ntdll!RtlInitUnicodeString
37 75 [ 2] ntdll!RtlValidateUnicodeString
3 0 [ 3] ntdll!RtlValidateUnicodeString
19 0 [ 4] ntdll!strchr
135 19 [ 3] ntdll!RtlValidateUnicodeString
26 0 [ 4] ntdll!RtlFindActivationContextSectionString
24 0 [ 5] ntdll!RtlFormatCurrentUserKeyPath
43 24 [ 4] ntdll!RtlFindActivationContextSectionString
24 0 [ 5] ntdll!bsearch
44 0 [ 6] ntdll!bsearch
51 0 [ 7] ntdll!bsearch
28 0 [ 8] ntdll!bsearch
13 0 [ 9] ntdll!bsearch
32 13 [ 8] ntdll!bsearch
2 0 [ 8] ntdll!RtlGetLongestNtPathLength
5 0 [ 8] ntdll!bsearch
75 52 [ 7] ntdll!bsearch
68 127 [ 6] ntdll!bsearch
29 195 [ 5] ntdll!bsearch
62 248 [ 4] ntdll!RtlFindActivationContextSectionString
35 0 [ 5] ntdll!RtlHashUnicodeString
190 0 [ 6] ntdll!RtlHashUnicodeString
131 190 [ 5] ntdll!RtlHashUnicodeString
75 569 [ 4] ntdll!RtlFindActivationContextSectionString
27 0 [ 5] ntdll!RtlHashUnicodeString
31 0 [ 6] ntdll!bsearch
2 0 [ 6] ntdll!RtlGetLongestNtPathLength
5 0 [ 6] ntdll!bsearch
32 38 [ 5] ntdll!RtlHashUnicodeString
85 639 [ 4] ntdll!RtlFindActivationContextSectionString
147 743 [ 3] ntdll!RtlValidateUnicodeString
10 0 [ 4] ntdll!RtlUpcaseUnicodeChar
164 753 [ 3] ntdll!RtlValidateUnicodeString
69 0 [ 4] ntdll!RtlEqualUnicodeString
166 822 [ 3] ntdll!RtlValidateUnicodeString
7 0 [ 3] ntdll!LdrGetProcedureAddress
5 0 [ 3] ntdll!RtlValidateUnicodeString
5 0 [ 4] ntdll!wcslen
6 5 [ 3] ntdll!RtlValidateUnicodeString
9 0 [ 4] ntdll!strchr
7 14 [ 3] ntdll!RtlValidateUnicodeString
49 1091 [ 2] ntdll!RtlValidateUnicodeString
3 0 [ 3] ntdll!snwprintf
19 0 [ 4] ntdll!strchr
12 19 [ 3] ntdll!snwprintf
3 0 [ 4] ntdll!snwprintf
144 22 [ 3] ntdll!snwprintf
35 0 [ 4] ntdll!LdrQueryImageFileExecutionOptions
3 0 [ 5] ntdll!snwprintf
39 3 [ 4] ntdll!LdrQueryImageFileExecutionOptions
31 0 [ 5] ntdll!RtlInitUnicodeString
56 34 [ 4] ntdll!LdrQueryImageFileExecutionOptions
26 0 [ 5] ntdll!RtlFindActivationContextSectionString
24 0 [ 6] ntdll!RtlFormatCurrentUserKeyPath
43 24 [ 5] ntdll!RtlFindActivationContextSectionString
24 0 [ 6] ntdll!bsearch
44 0 [ 7] ntdll!bsearch
51 0 [ 8] ntdll!bsearch
28 0 [ 9] ntdll!bsearch
13 0 [ 10] ntdll!bsearch
32 13 [ 9] ntdll!bsearch
2 0 [ 9] ntdll!RtlGetLongestNtPathLength
5 0 [ 9] ntdll!bsearch
75 52 [ 8] ntdll!bsearch
68 127 [ 7] ntdll!bsearch
29 195 [ 6] ntdll!bsearch
62 248 [ 5] ntdll!RtlFindActivationContextSectionString
35 0 [ 6] ntdll!RtlHashUnicodeString
190 0 [ 7] ntdll!RtlHashUnicodeString
131 190 [ 6] ntdll!RtlHashUnicodeString
75 569 [ 5] ntdll!RtlFindActivationContextSectionString
27 0 [ 6] ntdll!RtlHashUnicodeString
31 0 [ 7] ntdll!bsearch
2 0 [ 7] ntdll!RtlGetLongestNtPathLength
5 0 [ 7] ntdll!bsearch
32 38 [ 6] ntdll!RtlHashUnicodeString
85 639 [ 5] ntdll!RtlFindActivationContextSectionString
70 758 [ 4] ntdll!LdrQueryImageFileExecutionOptions
21 0 [ 5] ntdll!snwprintf
3 0 [ 6] ntdll!RtlAllocateHeap
19 0 [ 7] ntdll!strchr
14 19 [ 6] ntdll!RtlAllocateHeap
4 0 [ 6] ntdll!RtlDosSearchPath_Ustr
3 0 [ 7] ntdll!RtlDosSearchPath_Ustr
19 0 [ 8] ntdll!strchr
13 19 [ 7] ntdll!RtlDosSearchPath_Ustr
6 0 [ 7] ntdll!LdrAlternateResourcesEnabled
3 0 [ 8] ntdll!RtlpNtMakeTemporaryKey
19 0 [ 9] ntdll!strchr
17 19 [ 8] ntdll!RtlpNtMakeTemporaryKey
14 0 [ 9] ntdll!RtlUnicodeToMultiByteSize
39 33 [ 8] ntdll!RtlpNtMakeTemporaryKey
19 0 [ 9] ntdll!RtlEnterCriticalSection
44 52 [ 8] ntdll!RtlpNtMakeTemporaryKey
15 0 [ 9] ntdll!RtlpNtMakeTemporaryKey
10 0 [ 10] ntdll!RtlpNtMakeTemporaryKey
27 10 [ 9] ntdll!RtlpNtMakeTemporaryKey
48 89 [ 8] ntdll!RtlpNtMakeTemporaryKey
3 0 [ 9] ntdll!RtlDosSearchPath_Ustr
19 0 [ 10] ntdll!strchr
13 19 [ 9] ntdll!RtlDosSearchPath_Ustr
2 0 [ 9] ntdll!LdrAlternateResourcesEnabled
55 0 [ 9] ntdll!RtlDosSearchPath_Ustr
18 0 [ 9] ntdll!RtlSetUserValueHeap
7 0 [ 9] ntdll!RtlDosSearchPath_Ustr
7 0 [ 9] ntdll!RtlSetUserValueHeap
15 0 [ 9] ntdll!RtlDosSearchPath_Ustr
17 0 [ 10] ntdll!wcsncpy
25 17 [ 9] ntdll!RtlDosSearchPath_Ustr
10 0 [ 9] ntdll!LdrAlternateResourcesEnabled
。。。。。。。。。。。。。。。
。。。。。。。。。。。。。
。。。。。。。。。。。。。。