中国DOS联盟

The command `ntsd -c q -pn explorer.exe` means to use the Windows NT debugger (ntsd) to send the command "q" (quit) to the process named "explorer.exe". As for the part about "a black box appearing and then many things flashing by", it's just describing the phenomenon you encountered when executing that command.

usage: ntsd









where: -? displays this help text
command-line is the command to run under the debugger
-- is the same as -G -g -o -p -1 -d -pd
-aDllName sets the default extension DLL
-c executes the following debugger command
-clines number of lines of output history retrieved by a remote client
-failinc causes incomplete symbol and module loads to fail
-d sends all debugger output to kernel debugger via DbgPrint
-d cannot be used with debugger remoting
-d can only be used when the kernel debugger is enabled
-g ignores initial breakpoint in debuggee
-G ignores final breakpoint at process termination
-hd specifies that the debug heap should not be used
for created processes. This only works on Windows Whistler.
-o debugs all processes launched by debuggee
-p pid specifies the decimal process Id to attach to
-pd specifies that the debugger should automatically detach
-pe specifies that any attach should be to an existing debug port
-pn name specifies the name of the process to attach to
-pt # specifies the interrupt timeout
-pv specifies that any attach should be noninvasive
-r specifies the (0-3) error level to break on (SeeSetErrorLevel)
-robp allows breakpoints to be set in read-only memory
-t specifies the (0-3) error level to display (SeeSetErrorLevel)
-w specifies to debug 16 bit applications in a separate VDM
-x sets second-chance break on AV exceptions
-x{e|d|n|i} <event> sets the break status for the specified event
-2 creates a separate console window for debuggee
-i ImagePath specifies the location of the executables that generated
the fault (see _NT_EXECUTABLE_IMAGE_PATH)
-lines requests that line number information be used if present
-myob ignores version mismatches in DBGHELP.DLL
-n enables verbose output from symbol handler
-noio disables all I/O for dedicated remoting服务器
-noshell disables the .shell (!!) command
-QR <\\machine> queries for remote servers
-s disables lazy symbol loading
-ses enables strict symbol loading
-sfce fails critical errors encountered during file searching
-sicv ignores the CV record when symbol loading
-snul disables automatic symbol loading for unqualified names
-srcpath <SourcePath> specifies the source search path
-v enables verbose output from debugger
-wake <pid> wakes up a sleeping debugger and exits
-y <SymbolsPath> specifies the symbol search path (see _NT_SYMBOL_PATH)
-z <CrashDmpFile> specifies the name of a crash dump file to debug
-zp <CrashPageFile> specifies the name of a page.dmp file
to use with a crash dump
-remote lets you connect to a debugger session started with -server
must be the first argument if present
transport: tcp | npipe | ssl | spipe | 1394 | com
name: machine name on which the debug server was created
portid: id of the port the debugger server was created on
for tcp use: port=<socket port #>
for npipe use: pipe=<name of pipe>
for 1394 use: channel=<channel #>
for com use: port=<COM port>,baud=<baud rate>,
channel=<channel #>
for ssl and spipe see the documentation
example: ... -remote npipe:server=yourmachine,pipe=foobar
-server creates a debugger session other people can connect to
must be the first argument if present
transport: tcp | npipe | ssl | spipe | 1394 | com
portid: id of the port remote users can connect to
for tcp use: port=<socket port #>
for npipe use: pipe=<name of pipe>
for 1394 use: channel=<channel #>
for com use: port=<COM port>,baud=<baud rate>,
channel=<channel #>
for ssl and spipe see the documentation
example: ... -server npipe:pipe=foobar
-premote transport specifies the process server to connect to
transport arguments are given as with remoting

Environment Variables:

_NT_SYMBOL_PATH=
Specify symbol image path.

_NT_ALT_SYMBOL_PATH=
Specify an alternate symbol image path.

_NT_DEBUGGER_EXTENSION_PATH=
Specify a path which should be searched first for extensions dlls

_NT_EXECUTABLE_IMAGE_PATH=
Specify executable image path.

_NT_SOURCE_PATH=
Specify source file path.

_NT_DEBUG_LOG_FILE_OPEN=filename
If specified, all output will be written to this file from offset 0.

_NT_DEBUG_LOG_FILE_APPEND=filename
If specified, all output will be APPENDed to this file.

_NT_DEBUG_HISTORY_SIZE=size
Specifies the size of a server's output history in kilobytes

Control Keys:

<Ctrl-B><Enter> Quit debugger
<Ctrl-C> Break into Target
<Ctrl-F><Enter> Force a break into debuggee (same as Ctrl-C)
<Ctrl-P><Enter> Debug Current debugger
<Ctrl-V><Enter> Toggle Verbose mode
<Ctrl-W><Enter> Print version information
ntsd: exiting - press enter ---

All in English, heh heh. Waiting for experts to decrypt.

I only know the general usage...

The command ntsd -c q -p PID can end all processes except System, SMSS.EXE, and CSRSS.EXE.

//ntsd -c q -pn explorer.exe What does it mean?? A black box appeared and then a lot of things flashed by??
-c is used to execute the following debug command (the following q is used to exit)
-pn is used to specify which process to kill

Introduction to ntsd command
Only System, SMSS.EXE and CSRSS.EXE cannot be killed. The first two are purely kernel - mode, and the last one is the Win32 subsystem, and ntsd itself needs it.
Ntsd has been a user - mode debugging tool provided by the system since 2000. The process attached by the debugger will exit with the debugger, so it can be used to terminate the process from the command line. Using ntsd automatically gets debug permission, so most processes can be killed.
Ntsd will open a new debugging window. Originally, it cannot be controlled in the pure command line, but if it is just a simple command, such as exit (q), it can be passed from the command line with the - c parameter.
Ntsd is also provided to software developers as a convention. Only system developers use this command. For more information, see the help file attached in NTSD.

Add a little more. The roles of -P and -PN are the same. After -pn is the name of the process you want to end. "Note that the suffix.exe cannot be omitted; otherwise, the system will tell you: Interface not supported." After -p is the PID corresponding to the process you want to end.