使用“无银第八哥”给注册表 API 下断点,结果调用极其频繁,如果一个个人工去看,容易逐渐失去耐心。毕竟,挨踢太卷了!
解决
您只需要“条件断点”!但是怎么写“条件”成为拦路虎。
好在,“无银第八哥”自带了一份很简要的学习材料,您可以在帮助菜单打开,或按 F1,或在命令窗口输入 .hh 打开,然后输入“conditional breakpoints”,将进入一篇名为《Conditional breakpoints in WinDbg and other Windows debuggers》的帮助文档。
The GetEnvironmentStrings function has a long and troubled history.
The first bit of confusion is that the day it was introduced in Windows NT 3.1, it was exported funny. The UNICODE version was exported under the name GetEnvironmentStringsW, but the ANSI version was exported under the name GetEnvironmentStrings without the usual A suffix.
A mistake we have been living with for over two decades.
虽然后来可以解决这个例外,但微软选择保留此例外。
结论
大家可以不必担心相关的可能问题,因为现代的 Windows 会同时导出 GetEnvironmentStrings 和 GetEnvironmentStringsA。
Windows 10 introduces TraceLogging which builds on ETW and provides a simplified way to instrument code for native, .NET and WinRT developers.
TraceLogging is a system for logging events that can be decoded without a manifest. On Windows, TraceLogging is used in user-mode and kernel-mode to generate Event Tracing for Windows (ETW) events. TraceLogging builds on Event Tracing for Windows (ETW) and provides a simplified way to instrument code.