ntsd.exe是一款功能強大的進程結束工具，它可以用于強制結束需要結速的進程，有時候系統中某些進程無法結束，這時就可以使用ntsd.exe工具來進行強制結束。操作簡單便捷，需要的朋友可以來本站下載使用！

ntsd.exe介紹

NTSD的功能非常的強大,用它強行結束某個比較頑固的進程還是很好用的,基本上除了WINDOWS系統自己的管理進程,ntsd幾乎都可以殺掉.XP下是自帶的,但是Win7沒有,下載後解壓到C:/windows/system32下,然後在cmd下,就可以進行操作了.

ntsd.exe使用命令

NTSD(Microsoft Windows NT Symbolic/Systems Debugger)是Windows 2000(Microsoft Windows XP)默认安装的一

個調試器。這其實是一個命令行版本的WinDBG，功能上稍微縮了一點水，但是對一般的調試

來說是足夠用了。

usage: NTSD [-v] [-2] [-d] [-o] [-g] [-G] [-w] [-lines]

[-aDllName] [-s] [-r BreakErrorLevel] [-t PrintErrorLevel]

[-hd] [-x | -xd [except#] | -xe [except#]] [-e] [-z]

[-- | -p pid | command-line]

where: -? displays this help text

-aDllName sets the default extension DLL

-c executes the following debugger command

指定要執行的調試命令，多個命令之間用“;”分隔

-d sends all debugger output to kernel debugger via DbgPrint

-g ignores initial breakpoint in debuggee

-G ignores final breakpoint at process termination

-hd disables heap manager validity checking

-i ignores AV generated by loader fixups on pre3.51 systems

-lines requests that line number information be used if present

-netsyms:{yes|no} allow or disallow loading symbols from a network path

-o debugs all processes launched by debuggee

-r specifies the (0-3) error level to break on (SeeSetErrorLevel)

-s disables lazy symbol loading

-t specifies the (0-3) error level to display (SeeSetErrorLevel)

-v enables verbose output from debugger

-n enables verbose output from symbol handler

-w specifies to debug 16 bit applications in a separate VDM

-x disables break on AV exceptions

-xd disables stopping on specified exception

-xe enables stopping on specified exception

-z reserved for OS/2 debugging

-2 creates a separate console window for debuggee

對于控制台程序，將輸出定向到另一個窗口而不在NTSD窗口顯示

-- is the same as -G -g -o -p -1

-p pid specifies the decimal process Id to attach to

指定要調試的進程號，用于調試已經運行的程序

command-line is the command to run under the debugger

Environment Variables:

_NT_SYMBOL_PATH=[Drive:][Path]

Specify symbol image path. (Default = %SystemRoot%)

_NT_ALT_SYMBOL_PATH=[Drive:][Path]

Specify an alternate symbol image path.

_NT_DEBUG_EXTENSIONS=dllname(s)

If specified, it is a semi-colon separated list of debugger extension DLL names

This specifies the search order when resolving debugger extension commands

A [

] - assemble

在指定地址輸入彙編語句

BC[] - clear breakpoint(s)

清除斷點

BD[] - disable breakpoint(s)

禁用斷點

BE[] - enable breakpoint(s)

啓用斷點

BL[] - list breakpoint(s)

列出斷點

BP[#]

- set breakpoint

設斷點

C

- compare

比較地址

D[type][] - dump memory

顯示指定內存範圍

E[type]

[] - enter

在指定地址輸入數據

F - fill

在指定內存段填充數據

G [=

[

...]] - go

運行到某個地址

J [']cmd1['];[']cmd2['] - conditional execution

條件執行

K - stacktrace

堆棧回溯

KB = - stacktrace from specific state

L{+|-}[lost*] - Control source options

LN - list near

參數爲地址或者函數，顯示距離參數中指定地址或者函數最近的函數

LS[.] [][,] - List source file lines

LSA [,][,] - List source file lines at addr

LSC - Show current source file and line

LSF[-] - Load or unload a source file for browsing

M

- move

N [] - set / show radix

P[R] [=] [] - program step

單步執行

Q - quit

#R - multiprocessor register dump

多處理器環境下顯示寄存器

R[F][L][M ] [[ [= ]]] - reg/flag

顯示寄存器

Rm[?] [] - Control prompt register output mask

S - search

在指定地址範圍內搜尋字符串

0:000> s 77df0000 77e4c000 ff e4 //从user32的空间中找jmp esp

77e22c29

0:000> s 77df0000 77e4c000 'W' 'I' 'N' 'N' 'T' //搜索字符串“WINNT”

SS - set symbol suffix

SX [e|d [<:event>|*|]] - exception

T[R] [=

] [] - trace

U [] - unassemble

顯示反彙編語句，同softice的U命令

X [<*|module>!]<*|symbol> - view symbols

顯示符號，支持通配符，類似于softice的exp命令

0:000> x user32!* //显示user32的所有符号

…………

0:000> x user32!ws* //显示user32的所有以ws开头的符号

77dffa68 USER32!wsprintfW

77e0014a USER32!wsprintfA

.logopen [] - open new log file

指定日志文件，開啓屏幕記錄非常有用的功能

.logappend [] - append to log file

添加到已存在的日志文件

.logclose - close log file

停止記錄

~ - list threads status

顯示線程狀態

~#s - set default thread

設置默認線程

~[.|#|*|ddd]f - freeze thread

~[.|#|ddd]k[expr] - backtrace stack

堆棧追蹤

| - list processes status

顯示進程狀態

|#s - set default process

設置默認進程

|# - default process override

? - display expression

顯示地址或者符號信息

0:000> ? wsprintfA

Evaluate expression: 2011169098 = 77e0014a

0:000> ? eip

Evaluate expression: 2012813324 = 77f9180c

# [address] - search for a string in the dissasembly

反彙編指定地址，但是只輸出一行語句

$< - take input from a command file

從文件取得要輸入的命令

ops: + - * / not by wo dw poi mod(%) and(&) xor(^) or(|) hi low

operands: number in current radix, public symbol,

: b (byte), w (word), d (doubleword [with symbols]),

a (ascii), c (dword and Char), u (unicode), l (list)

f (float), D (double), s|S (ascii/unicode string)

q (quadword)

: [(nt | )!] ( can include ? and *)

<:event>: ct, et, ld, av, cc

: 8, 10, 16

: $u0-$u9, $ea, $exp, $ra, $p

: %<32-bit address>

:

:

L

: [ ...]

User-mode options:

i386 options:

BA[#] <e|r|w|i><1|2|4> - addr bp

: [e]ax, [e]bx, [e]cx, [e]dx, [e]si, [e]di, [e]bp, [e]sp, [e]ip, [e]fl,

al, ah, bl, bh, cl, ch, dl, dh, cs, ds, es, fs, gs, ss

fpcw, fpsw, fptw, st0-st7, mm0-mm7

: iopl, of, df, if, tf, sf, zf, af, pf, cf

: #<16-bit protect-mode [seg:]address>,

&

NTSD還支持一些很有用的命令，但是不知爲什麽幫助中卻沒有提，這裏也列出來：

KD [] - stack trace with raw data

raw模式堆棧回溯

SQ - set quiet mode

設置安靜模式，運行一次打開，再運行則關閉

LD [] - refresh module information

重新載入

LM list modules

列出進程加載的所有模塊信息

DL

- dump linked list

NTSD支持的表達式和WinDBG差不多是一樣的，MASM的語法。

系統自帶的NTSD也支持部分擴展命令，如：

!peb

!teb

英文版本

进程文件: ntsd.exe or ntsd

进程名称: Symbolic Debugger for Windows

描述:

ntsd.exe is a process belonging to the Microsoft symbolic debugger that enables you to debug user-mode applications. This program is a non-essential process, but should not be terminated unless suspected to be causing problems.

Recommendation for ntsd.exe:

ntsd.exe should not be disabled, required for essential applications to work properly.

Author: Microsoft

Part Of: Microsoft Windows Operating System

安全等级 (0-5): 0

间谍軟件: No

病毒: No ( Remove ntsd.exe )

木马: No ( Remove ntsd.exe )

Memory Usage: N/A

System Process: Yes

Background Process: No

Uses Network: No

Hardware Related: No

Common ntsd.exe Errors: N/A