callstack.exe ============= view call stack using pdb symbols usage syntax : callstack dbgloop ======= opens a process in a debugger, watches debug events usage syntax : dbgloop note : it monitors exe.exe, dll.dll files. do not change their folders. dbgattach ========= attaches to existing processes in a debugger, watches debug events usage syntax : dbgattach note : not working properly. attaches properly but exits debug loop. probably need to handle some process attach events. or probably some administrative privilege problem. Need to investigate ! disasm ====== disassembles a PE file. usage syntax : disasm note : works on .exe, .dll, .ocx, .cpl + also .Net binaries. But will not dump complete info exe === loads a dll. watch thread attachment + dll load events usage syntax : exe note : dynamically loads dll.dll. don't change folder hSymbol ======= loads, displays debug symbols for a binary usge syntax : hSymbol note : ensure that the debug symbols (.pdb) are present in the same folder as the executable intcpt ====== dynamic code insertion into another process usage syntax : intcp memdisp ======= display memory contents in hex usage syntax : memdisp
note : please ensure that the address is in decimal and not hex. penum ===== process, thread, module enumerator usage syntax : penum vmquery ======= display the virtual address space usage syntax : vmquery note : use pid as 0, for current process