wt [WatchOptions] [= StartAddress] [EndAddress]

 

Transcribing the WinDbg documentation, this command runs through the whole function and then displays statistics when executed at the beginning of a function call. Thus, this command can be used just when doing live debugging, not post mortem debugging (dump analysis).

Think about Watch and Trace.

 

The WinDbg help file describes all options for WatchOptions. Usually we use the simplest form, not these options.

 

To demonstrate this command, let’s use this simple Visual C++ application that recursively calculates the Fibonacci from a specific number:

 

#include "stdafx.h"

 

using namespace std;

 

// Recursive function.

unsigned FiboRecursive(unsigned n, int nNum = 0)

{       

          if(n <= 1)

          {

                    return n;

          }

                   

          return FiboRecursive(n - 1, 1) + FiboRecursive(n - 2, 2);

}

 

int _tmain(int argc, _TCHAR* argv[])

{

          cout << FiboRecursive(5) << endl;

 

          return 0;

}

 

 

Now we run the application from WinDbg and insert a breakpoint in the beginning of _tmain().

After hitting the breakpoint, we disassemble the function:

 

0:000> uf Fibo!wmain

Fibo!wmain [c:\development\my tools\book\fibo\fibo\fibo.cpp @ 20]:

   20 001b1440 55              push    ebp

   20 001b1441 8bec            mov     ebp,esp

   20 001b1443 81ecc0000000    sub     esp,0C0h

   20 001b1449 53              push    ebx

   20 001b144a 56              push    esi

   20 001b144b 57              push    edi

   20 001b144c 8dbd40ffffff    lea     edi,[ebp-0C0h]

   20 001b1452 b930000000      mov     ecx,30h

   20 001b1457 b8cccccccc      mov     eax,0CCCCCCCCh

   20 001b145c f3ab            rep stos dword ptr es:[edi]

   21 001b145e 8bf4            mov     esi,esp

   21 001b1460 a198821b00      mov     eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (001b8298)]

   21 001b1465 50              push    eax

   21 001b1466 6a00            push    0

   21 001b1468 6a05            push    5

   21 001b146a e89bfbffff      call    Fibo!ILT+5(?FiboRecursiveYAIIHZ) (001b100a)

   21 001b146f 83c408          add     esp,8

   21 001b1472 8bfc            mov     edi,esp

   21 001b1474 50              push    eax

   21 001b1475 8b0d90821b00    mov     ecx,dword ptr [Fibo!_imp_?coutstd (001b8290)]

   21 001b147b ff1594821b00    call    dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (001b8294)]

   21 001b1481 3bfc            cmp     edi,esp

   21 001b1483 e8d1fcffff      call    Fibo!ILT+340(__RTC_CheckEsp) (001b1159)

   21 001b1488 8bc8            mov     ecx,eax

   21 001b148a ff159c821b00    call    dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (001b829c)]

   21 001b1490 3bf4            cmp     esi,esp

   21 001b1492 e8c2fcffff      call    Fibo!ILT+340(__RTC_CheckEsp) (001b1159)

   23 001b1497 33c0            xor     eax,eax

   24 001b1499 5f              pop     edi

   24 001b149a 5e              pop     esi

   24 001b149b 5b              pop     ebx

   24 001b149c 81c4c0000000    add     esp,0C0h

   24 001b14a2 3bec            cmp     ebp,esp

   24 001b14a4 e8b0fcffff      call    Fibo!ILT+340(__RTC_CheckEsp) (001b1159)

   24 001b14a9 8be5            mov     esp,ebp

   24 001b14ab 5d              pop     ebp

   24 001b14ac c3              ret

 

Let’s use the address right before the recursive function call as the Start address and the address right after it as the End address of wt. Note the “=” right before the first address.

 

0:000> wt =001b1468  001b146f

    2     0 [  0] Fibo!wmain

    1     0 [  1]   Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   64     0 [  1]   Fibo!FiboRecursive

    1     0 [  2]     Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   64     0 [  2]     Fibo!FiboRecursive

    1     0 [  3]       Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   64     0 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   64     0 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  5]           Fibo!FiboRecursive

    1     0 [  6]             Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  6]             Fibo!_RTC_CheckEsp

   70     3 [  5]           Fibo!FiboRecursive

   71    74 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  5]           Fibo!FiboRecursive

    1     0 [  6]             Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  6]             Fibo!_RTC_CheckEsp

   70     3 [  5]           Fibo!FiboRecursive

   79   148 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  5]           Fibo!_RTC_CheckEsp

   82   151 [  4]         Fibo!FiboRecursive

   71   234 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  5]           Fibo!_RTC_CheckEsp

   70     3 [  4]         Fibo!FiboRecursive

   79   308 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  4]         Fibo!_RTC_CheckEsp

   82   311 [  3]       Fibo!FiboRecursive

   71   394 [  2]     Fibo!FiboRecursive

    1     0 [  3]       Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   64     0 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  5]           Fibo!_RTC_CheckEsp

   70     3 [  4]         Fibo!FiboRecursive

   71    74 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  5]           Fibo!_RTC_CheckEsp

   70     3 [  4]         Fibo!FiboRecursive

   79   148 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  4]         Fibo!_RTC_CheckEsp

   82   151 [  3]       Fibo!FiboRecursive

   79   628 [  2]     Fibo!FiboRecursive

    1     0 [  3]       Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  3]       Fibo!_RTC_CheckEsp

   82   631 [  2]     Fibo!FiboRecursive

   71   714 [  1]   Fibo!FiboRecursive

    1     0 [  2]     Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   64     0 [  2]     Fibo!FiboRecursive

    1     0 [  3]       Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   64     0 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  5]           Fibo!_RTC_CheckEsp

   70     3 [  4]         Fibo!FiboRecursive

   71    74 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  4]         Fibo!FiboRecursive

    1     0 [  5]           Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  5]           Fibo!_RTC_CheckEsp

   70     3 [  4]         Fibo!FiboRecursive

   79   148 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  4]         Fibo!_RTC_CheckEsp

   82   151 [  3]       Fibo!FiboRecursive

   71   234 [  2]     Fibo!FiboRecursive

    1     0 [  3]       Fibo!ILT+5(?FiboRecursiveYAIIHZ)

   67     0 [  3]       Fibo!FiboRecursive

    1     0 [  4]         Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  4]         Fibo!_RTC_CheckEsp

   70     3 [  3]       Fibo!FiboRecursive

   79   308 [  2]     Fibo!FiboRecursive

    1     0 [  3]       Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  3]       Fibo!_RTC_CheckEsp

   82   311 [  2]     Fibo!FiboRecursive

   79  1108 [  1]   Fibo!FiboRecursive

    1     0 [  2]     Fibo!ILT+340(__RTC_CheckEsp)

    2     0 [  2]     Fibo!_RTC_CheckEsp

   82  1111 [  1]   Fibo!FiboRecursive

 

1196 instructions were executed in 1195 events (0 from other threads)

 

Function Name                               Invocations MinInst MaxInst AvgInst

Fibo!FiboRecursive                                   15      70      82      75

Fibo!ILT+340(__RTC_CheckEsp)               15        1        1       1

Fibo!ILT+5(?FiboRecursiveYAIIHZ)            15        1        1       1

Fibo!_RTC_CheckEsp                                15        2       2       2

Fibo!wmain                                               1        2        2       2

 

0 system calls were executed

 

eax=00000005 ebx=7efde000 ecx=00000000 edx=00000001 esi=00000000 edi=00000000

eip=001b146f esp=0045f914 ebp=0045f964 iopl=0         nv up ei pl zr na pe nc

cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246

Fibo!wmain+0x2f:

001b146f 83c408          add     esp,8

 

 

 

Notice that the first number right below the command specifies the number of instructions that were executed, the second number specifies the number of instructions executed by child calls of the function, and the third number (in brackets) is the depth of the function in the stack.

MinInst, MaxInst and AvgInst mean the number of instructions by call.