我可以使用WinDbg转储其他平台的结构吗? [英] Can I use WinDbg to dump structs for other platforms?

问题描述

我正在使用WinDbg转储结构信息，例如:

I'm using WinDbg to dump struct information, for example:

lkd>dt nt！_LIST_ENTRY+ 0x000 Flink:Ptr32 _LIST_ENTRY+ 0x004闪烁:Ptr32 _LIST_ENTRY

上面的示例显示了 _LIST_ENTRY 结构的32位版本.64位版本更大， Blink 位于 0x008 .

The example above shows the 32-bit version of the _LIST_ENTRY struct. The 64-bit version is larger, with Blink at 0x008.

我知道只要加载适用于这些Windows版本的正确符号，就可以调试远程系统或分析故障转储.

I understand that I can debug remote systems or analyze crash dumps, as long as I load the correct symbols for those Windows versions.

我的问题:是否可以为与我正在运行的Windows版本不同的Windows版本转储结构，而无需进行远程调试或分析故障转储?

My question: Is it possible to dump structs for different Windows versions than the one I am running, without debugging remotely or analyzing a crash dump?

推荐答案

是的，只要您具有正确的符号，就可以为不同的Windows版本转储结构.

Yes so long as you have the correct symbols you can dump structs for different windows versions.

转储将包含Windows版本和必须与pdb匹配的符号所期望的签名.

The dump will contain the windows version and signature that is expected for the symbols that must match the pdbs.

编辑

关于在32位OS上调试64位转储/进程的特定问题，看来您需要在64位OS上使用64位WinDbg.

With respect to your specific issue of debugging a 64-bit dump/process on 32-bit OS, it looks like you need to be on a 64-bit OS and use the 64-bit WinDbg.

这篇关于我可以使用WinDbg转储其他平台的结构吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！