KernelDebugRef - Using Default Commands
Reprint Courtesy of International Business Machines Corporation, © International Business Machines Corporation
Using Default Commands
- ##Z
This command executes the default command. The default command is a string of debugger commands that are executed any time the debugger is entered and there is no breakpoint command attached to the entry. It starts as only the R command, but any string of commands can be used.
- ##ZL
This command lists the default command.
- ##ZS <string>
This command changes the default command. If there are any errors (too long), it returns to the R command.
If you want to process through all the INT 3s in your application or test program, you can use the following command:
ZS "J (BY CS:EIP) == CC 'G';R"
This restarts execution every time you enter the debugger on an INT 3.
A watchpoint can be set up as follows:
ZS "J (WO 40:1234) == 0EED 'r'; T"
This command traces until the word at 40:1234 is equal to hex 0EED. This will not work if you are tracing through the mode-switching code in the operating system or other sections of code that cannot be traced.