How to redirect the windbg command to a file without repeating the output on the windbg console?

.logopen This is not an answer because it allows the command to output windbg to the console.

For example, it !sosex.dumpgen 2creates a lot of output that I do not want to see in the debugger console. Now I am using the following:

.shell -i- -ci "!dumpgen 2" cmd /c more > D:\tmp\dumpgen2.log

My problem is that the command moreis interactive and requires user input after outputting a certain amount of data. This is a huge problem for me.

One solution may be the debugger itself is not interactive with the script and use the .logopen command there.

I wonder if I can achieve what I want so far:

  • Performing this action from an interactive WinDbg session
  • Using simple standard shell commands (which can also be cmd.exe or powershell.exe). I know that writing a small utility that simply translates stdin to stdout is trivial work, but I prefer not to.
+4
source share
2 answers
.shell -i- -ci "!dumpgen 2" findstr "^" >D:\tmp\dumpgen2.log

^ will find the beginning of any line, so it should be a 1: 1 copy.

+4
source

you can also use gnuwin32 cat

C:\>dir /b foogg.txt   
File Not Found

C:> cdb -c ".shell -ci \" lm \ "-o \" c: \\ foogg.txt \ "cat -" calc.exe

0:000> cdb: Reading initial command '.shell -ci "lm" -o "c:\\\\foogg.txt" cat -'

<.shell waiting 10 second(s) for process>
.shell: Process exited
0:000> q
quit:

check if the file exists and print its contents

C:\>dir /b foogg.txt
foogg.txt

C:\>cat foogg.txt

start    end        module name
01000000 0101f000   calc       (deferred)
77c10000 77c68000   msvcrt     (deferred)
77dd0000 77e6b000   ADVAPI32   (deferred)
77e70000 77f02000   RPCRT4     (deferred)
77f10000 77f59000   GDI32      (deferred)
77f60000 77fd6000   SHLWAPI    (deferred)
77fe0000 77ff1000   Secur32    (deferred)
7c800000 7c8f6000   kernel32   (deferred)
7c900000 7c9b2000   ntdll      (pdb symbols)
7c9c0000 7d1d7000   SHELL32    (deferred)
7e410000 7e4a1000   USER32     (deferred)
0
source

Source: https://habr.com/ru/post/1614512/


All Articles