在windbg中，如何在kernel32.dll中的所有函数上设置断点？

Question

I want figure out the call sequence and functions to kernel32.dll in a function example() in example.DLL .

In windbg, how to set breakpoint on all functions in kernel32.dll?

I tried bm kernel32!* , but seems not work.

Answer 1

I would not do just as stated. Of course it is possible, but if done with bm /a kernel32!* you inadvertently set bps also on data symbols (as opposed to actual functions). In your case wt - trace and watch data (you can look it up in the debugger.chm provided with your windbg package) might be what you're after.

Answer 2

Setting breakpoints at some low level kernel service DLL call may cause application exceptions.

You may use rohitab's API monitor to observe its DLL calls and then set breakpoints on your interesting calls.

Answer 3

Kernel32 is a heavily used DLL - you'll probably find that breaking on every function is way too noisy. You also don't need to break on every kernel32 function, just the ones it exports.

If I were you, I'd run "link /dump /exports kernel32.dll", write the outputs to a file, then write a simple script that will grab the function name and write out "bp kernel32!" + the function name to a new file. Then, simply paste the contents of that file into the windbg command window.

There is probably a straightforward way to do this with the scripting support in the debuggers, but you could hack the above script together in the time less time it'd take to learn how to do it via debugger scripting.