All geek questions in one place

How to view the value of registers in a specific call stack stack in windbg

I am studying a Windows dump file in WinDBG. I can switch the frame of the call stack with the .frame command, but I found that the registers always contain the last context. I mean, if you can restore a context that belongs to a specific frame of the call stack that is not top?

+6
source share
2 answers

If you are debugging an x64 target, you can use:

.frame /r

To view the registers in the frame. This information is based on image unwinding data, so it is fairly reliable. You can also change the context with:

 .frame /c

On x86 there is no information to unwind, so this trick does not work .. frame will still show you something for registers, but it is unlikely to be correct (it will be basically just the right luck).

+7
source

try findthis.py, which is the type of CFI retrieval (call frame information) by parsing the prolog of each frame in a freeze frame.

http://nick.luckygarden.org/find-this-ptr-within-a-callstack-in-a-dump-file/

0
source

Source: https://habr.com/ru/post/912555/

More articles:


All Articles