ntsd.exe下载|ntsd.exe 最新免费版下载

ntsd.exe是一款专门为Win7系统打造的进程终止软件,该软件可以用于强制结束进程,功能非常强大,知识兔用于那些强行结束的某个比较顽固的进程来说非常好用,除了Windows系统自己的管理进程,其他的都可以杀掉。

ntsd.exe

【使用方法】

NTSD(Microsoft Windows NT Symbolic/Systems Debugger)是Windows 2000(Microsoft Windows XP)默认安装的一个调试器。这其实是一个命令行版本的WinDBG,功能上稍微缩了一点水,但是对一般的调试来说是足够用了。
usage: NTSD [-v] [-2] [-d] [-o] [-g] [-G] [-w] [-lines]
[-aDllName] [-s] [-r BreakErrorLevel] [-t PrintErrorLevel]
[-hd] [-x | -xd [except#] | -xe [except#]] [-e] [-z]
[– | -p pid | command-line]
where: -? displays this help text
-aDllName sets the default extension DLL
-c executes the following debugger command
指定要执行的调试命令,多个命令之间用“;”分隔
-d sends all debugger output to kernel debugger via DbgPrint
-g ignores initial breakpoint in debuggee
-G ignores final breakpoint at process termination
-hd disables heap manager validity checking
-i ignores AV generated by loader fixups on pre3.51 systems
-lines requests that line number information be used if present
-netsyms:{yes|no} allow or disallow loading symbols from a network path
-o debugs all processes launched by debuggee
-r specifies the (0-3) error level to break on (SeeSetErrorLevel)
-s disables lazy symbol loading
-t specifies the (0-3) error level to display (SeeSetErrorLevel)
-v enables verbose output from debugger
-n enables verbose output from symbol handler
-w specifies to debug 16 bit applications in a separate VDM
-x disables break on AV exceptions
-xd disables stopping on specified exception
-xe enables stopping on specified exception
-z reserved for OS/2 debugging
-2 creates a separate console window for debuggee
对于控制台程序,将输出定向到另一个窗口而不在NTSD窗口显示
— is the same as -G -g -o -p -1
-p pid specifies the decimal process Id to attach to
指定要调试的进程号,知识兔用于调试已经运行的程序
command-line is the command to run under the debugger
Environment Variables:
_NT_SYMBOL_PATH=[Drive:][Path]
Specify symbol image path. (Default = %SystemRoot%)
_NT_ALT_SYMBOL_PATH=[Drive:][Path]
Specify an alternate symbol image path.
_NT_DEBUG_EXTENSIONS=dllname(s)
If specified, it is a semi-colon separated list of debugger extension DLL names
This specifies the search order when resolving debugger extension commands
A [

] – assemble
在指定地址输入汇编语句
BC[] – clear breakpoint(s)
清除断点
BD[] – disable breakpoint(s)
禁用断点
BE[] – enable breakpoint(s)
启用断点
BL[] – list breakpoint(s)
列出断点
BP[#]

– set breakpoint
设断点
C

– compare
比较地址
D[type][] – dump memory
显示指定内存范围
E[type]

[] – enter
在指定地址输入数据
F – fill
在指定内存段填充数据
G [=

[

…]] – go
运行到某个地址
J [']cmd1['];[']cmd2['] – conditional execution
条件执行
K – stacktrace
堆栈回溯
KB = – stacktrace from specific state
L{+|-}[lost*] – Control source options
LN – list near
参数为地址或者函数,显示距离参数中指定地址或者函数最近的函数
LS[.] [][,] – List source file lines
LSA [,][,] – List source file lines at addr
LSC – Show current source file and line
LSF[-] – Load or unload a source file for browsing
M

– move
N [] – set / show radix
P[R] [=] [] – program step
单步执行
Q – quit
#R – multiprocessor register dump
多处理器环境下显示寄存器
R[F][L][M ] [[ [= ]]] – reg/flag
显示寄存器
Rm[?] [] – Control prompt register output mask
S – search
在指定地址范围内搜寻字符串
0:000> s 77df0000 77e4c000 ff e4 //从user32的空间中找jmp esp
77e22c29
0:000> s 77df0000 77e4c000 'W' 'I' 'N' 'N' 'T' //搜索字符串“WINNT”
SS – set symbol suffix
SX [e|d [|*|]] – exception
T[R] [=

] [] – trace
U [] – unassemble
显示反汇编语句,同softice的U命令
X [<*|module>!]<*|symbol> – view symbols
显示符号,知识兔支持通配符,类似于softice的exp命令
0:000> x user32!* //显示user32的所有符号
…………
0:000> x user32!ws* //显示user32的所有以ws开头的符号
77dffa68 USER32!wsprintfW
77e0014a USER32!wsprintfA
.logopen [] – open new log file
指定日志文件,开启屏幕记录非常有用的功能
.logappend [] – append to log file
添加到已存在的日志文件
.logclose – close log file
停止记录
~ – list threads status
显示线程状态
~#s – set default thread
设置默认线程
~[.|#|*|ddd]f – freeze thread
~[.|#|ddd]k[expr] – backtrace stack
堆栈追踪
| – list processes status
显示进程状态
|#s – set default process
设置默认进程
|# – default process override
? – display expression
显示地址或者符号信息
0:000> ? wsprintfA
Evaluate expression: 2011169098 = 77e0014a
0:000> ? eip
Evaluate expression: 2012813324 = 77f9180c
# [address] – search for a string in the dissasembly
反汇编指定地址,但是只输出一行语句
$< – take input from a command file
从文件取得要输入的命令
ops: + – * / not by wo dw poi mod(%) and(&) xor(^) or(|) hi low
operands: number in current radix, public symbol,
: b (byte), w (word), d[s] (doubleword [with symbols]),
a (ascii), c (dword and Char), u (unicode), l (list)
f (float), D (double), s|S (ascii/unicode string)
q (quadword)
: [(nt | )!] ( can include ? and *)
: ct, et, ld, av, cc
: 8, 10, 16
: $u0-$u9, $ea, $exp, $ra, $p
: %<32-bit address>
:

:

L : [ …]
User-mode options:
i386 options:
BA[#] <1|2|4> – addr bp
: [e]ax, [e]bx, [e]cx, [e]dx, [e]si, [e]di, [e]bp, [e]sp, [e]ip, [e]fl,
al, ah, bl, bh, cl, ch, dl, dh, cs, ds, es, fs, gs, ss
fpcw, fpsw, fptw, st0-st7, mm0-mm7
: iopl, of, df, if, tf, sf, zf, af, pf, cf
: #<16-bit protect-mode [seg:]address>,
&
NTSD还支持一些很有用的命令,但是不知为什么帮助中却没有提,这里也列出来:
KD [] – stack trace with raw data
raw模式堆栈回溯
SQ – set quiet mode
设置安静模式,运行一次打开,再运行则关闭
LD [] – refresh module information
重新载入
LM list modules
列出进程加载的所有模块信息
DL

– dump linked list
NTSD支持的表达式和WinDBG差不多是一样的,MASM的语法。
系统自带的NTSD也支持部分扩展命令,如:
!peb
!teb
英文版本
进程文件: ntsd.exe or ntsd
进程名称: Symbolic Debugger for Windows
描述:
ntsd.exe is a process belonging to the Microsoft symbolic debugger that enables you to debug user-mode applications. This program is a non-essential process, but should not be terminated unless suspected to be causing problems.
Recommendation for ntsd.exe:
ntsd.exe should not be disabled, required for essential applications to work properly.
Author: Microsoft
Part Of: Microsoft Windows Operating System
安全等级 (0-5): 0
间谍软件: No
病毒: No ( Remove ntsd.exe )
木马: No ( Remove ntsd.exe )
Memory Usage: N/A
System Process: Yes
Background Process: No
Uses Network: No
Hardware Related: No
Common ntsd.exe Errors: N/A

【问题描述编辑】

出现提示缺少exe文件问题的大部分原因是因该文件被木马病毒破坏导致系统程序找不到此文件,出现错误提示框,或程序无法运行,知识兔解决此问题下载知识兔的exe文件,下载该文件后,找到适合程序的文件版本,复制到相应目录。即可解决。
1、Windows 95/98/Me系统,则复制到C:\WINdows\system32\ 目录下。
2、Windows NT/2000系统,则复制到C:\WINNT\system32\ 目录下。
3、Windows XP系统,则复制到C:\WINdows\system32\ 目录下。
4、Windows 7/8系统,则复制到C:\WINdows\system32\目录下。

下载仅供下载体验和测试学习,不得商用和正当使用。

下载体验

请输入密码查看下载!

如何免费获取密码?

点击下载

评论