Debugging Toolbox

Special Command—Unassembling code with u, ub and uf

Roberto Farah — Thu, 05 Nov 2009 21:27:00 GMT

When debugging sooner or later you will need to disassemble code to get a better understanding of that code.

By disassembling the code, you get the mnemonics translated from the 0s and 1s that constitute the binary code. It is a low level view of the code, but a higher level than seeing just numbers.

The commands syntaxes are:

u[b] [address]

u[b] [range]

u[b]

uf [options] <address>

Where options are:

/c - Displays only the call instructions in a routine.

/D - Creates linked callee names for navigation of the call graph.

/o - Sorts the display by address instead of by function offset.

/O - Creates linked call lines for accessing call information and creating breakpoints.

/i - Displays the number of instructions in a routine.

To demonstrate this command, let’s use this simple Visual C++ application that recursively calculates the Fibonacci from a specific number:

#include "stdafx.h"

using namespace std;

// Recursive function.

unsigned FiboRecursive(unsigned n, int nNum = 0)

{

if(n <= 1)

{

return n;

}

return FiboRecursive(n - 1, 1) + FiboRecursive(n - 2, 2);

}

int _tmain(int argc, _TCHAR* argv[])

{

cout << FiboRecursive(5) << endl;

return 0;

}

Let’s break the execution when the line from main() only is being executed, using a breakpoint for that.

Now let’s disassemble the eip register.

0:000> u @eip

Fibo!wmain+0x1e [c:\development\my tools\fibo\fibo\fibo.cpp @ 21]:

00a7145e 8bf4 mov esi,esp

00a71460 a19882a700 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (00a78298)]

00a71465 50 push eax

00a71466 6a00 push 0

00a71468 6a05 push 5

00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

00a7146f 83c408 add esp,8

00a71472 8bfc mov edi,esp

Using this approach we see the disassembled code starting from eip.

We can see the disassembled code that comes before eip using this approach:

0:000> ub @eip L8

Fibo!wmain+0x3 [c:\development\my tools\fibo\fibo\fibo.cpp @ 20]:

00a71443 81ecc0000000 sub esp,0C0h

00a71449 53 push ebx

00a7144a 56 push esi

00a7144b 57 push edi

00a7144c 8dbd40ffffff lea edi,[ebp-0C0h]

00a71452 b930000000 mov ecx,30h

00a71457 b8cccccccc mov eax,0CCCCCCCCh

00a7145c f3ab rep stos dword ptr es:[edi]

Keep in mind that b is for backward.

Let’s suppose you want to disassemble the entire function without having the work of finding the beginning of the function.

To accomplish that you use uf, and it automatically does that for you:

0:000> uf @eip

Fibo!wmain [c:\development\my tools\fibo\fibo\fibo.cpp @ 20]:

20 00a71440 55 push ebp

20 00a71441 8bec mov ebp,esp

20 00a71443 81ecc0000000 sub esp,0C0h

20 00a71449 53 push ebx

20 00a7144a 56 push esi

20 00a7144b 57 push edi

20 00a7144c 8dbd40ffffff lea edi,[ebp-0C0h]

20 00a71452 b930000000 mov ecx,30h

20 00a71457 b8cccccccc mov eax,0CCCCCCCCh

20 00a7145c f3ab rep stos dword ptr es:[edi]

21 00a7145e 8bf4 mov esi,esp

21 00a71460 a19882a700 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (00a78298)]

21 00a71465 50 push eax

21 00a71466 6a00 push 0

21 00a71468 6a05 push 5

21 00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

21 00a7146f 83c408 add esp,8

21 00a71472 8bfc mov edi,esp

21 00a71474 50 push eax

21 00a71475 8b0d9082a700 mov ecx,dword ptr [Fibo!_imp_?coutstd (00a78290)]

21 00a7147b ff159482a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (00a78294)]

21 00a71481 3bfc cmp edi,esp

21 00a71483 e8d1fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

21 00a71488 8bc8 mov ecx,eax

21 00a7148a ff159c82a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (00a7829c)]

21 00a71490 3bf4 cmp esi,esp

21 00a71492 e8c2fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

23 00a71497 33c0 xor eax,eax

24 00a71499 5f pop edi

24 00a7149a 5e pop esi

24 00a7149b 5b pop ebx

24 00a7149c 81c4c0000000 add esp,0C0h

24 00a714a2 3bec cmp ebp,esp

24 00a714a4 e8b0fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

24 00a714a9 8be5 mov esp,ebp

24 00a714ab 5d pop ebp

24 00a714ac c3 ret

Let’s see just the calls made by this function:

0:000> uf /c @eip

Fibo!wmain (00a71440) [c:\development\my tools\fibo\fibo\fibo.cpp @ 20]

Fibo!wmain+0x2a (00a7146a) [c:\development\my tools\fibo\fibo\fibo.cpp @ 21]:

call to Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

Fibo!wmain+0x3b (00a7147b) [c:\development\my tools\fibo\fibo\fibo.cpp @ 21]:

call to MSVCP90D!std::basic_ostream<char,std::char_traits<char> >::operator<< (690fa700) [f:\dd\vctools\crt_bld\self_x86\crt\src\ostream @ 289]

Fibo!wmain+0x43 (00a71483) [c:\development\my tools\fibo\fibo\fibo.cpp @ 21]:

call to Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

Fibo!wmain+0x4a (00a7148a) [c:\development\my tools\fibo\fibo\fibo.cpp @ 21]:

call to MSVCP90D!std::basic_ostream<char,std::char_traits<char> >::operator<< (690f9f60) [f:\dd\vctools\crt_bld\self_x86\crt\src\ostream @ 171]

Fibo!wmain+0x52 (00a71492) [c:\development\my tools\fibo\fibo\fibo.cpp @ 21]:

call to Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

Fibo!wmain+0x64 (00a714a4) [c:\development\my tools\fibo\fibo\fibo.cpp @ 24]:

call to Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

Creates linked callee names from the same function:

0:000> uf /D @eip

Fibo!wmain [c:\development\my tools\fibo\fibo\fibo.cpp @ 20]:

20 00a71440 55 push ebp

20 00a71441 8bec mov ebp,esp

20 00a71443 81ecc0000000 sub esp,0C0h

20 00a71449 53 push ebx

20 00a7144a 56 push esi

20 00a7144b 57 push edi

20 00a7144c 8dbd40ffffff lea edi,[ebp-0C0h]

20 00a71452 b930000000 mov ecx,30h

20 00a71457 b8cccccccc mov eax,0CCCCCCCCh

20 00a7145c f3ab rep stos dword ptr es:[edi]

21 00a7145e 8bf4 mov esi,esp

21 00a71460 a19882a700 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (00a78298)]

21 00a71465 50 push eax

21 00a71466 6a00 push 0

21 00a71468 6a05 push 5

21 00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

21 00a7146f 83c408 add esp,8

21 00a71472 8bfc mov edi,esp

21 00a71474 50 push eax

21 00a71475 8b0d9082a700 mov ecx,dword ptr [Fibo!_imp_?coutstd (00a78290)]

21 00a7147b ff159482a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (00a78294)]

21 00a71481 3bfc cmp edi,esp

21 00a71483 e8d1fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

21 00a71488 8bc8 mov ecx,eax

21 00a7148a ff159c82a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (00a7829c)]

21 00a71490 3bf4 cmp esi,esp

21 00a71492 e8c2fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

23 00a71497 33c0 xor eax,eax

24 00a71499 5f pop edi

24 00a7149a 5e pop esi

24 00a7149b 5b pop ebx

24 00a7149c 81c4c0000000 add esp,0C0h

24 00a714a2 3bec cmp ebp,esp

24 00a714a4 e8b0fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

24 00a714a9 8be5 mov esp,ebp

24 00a714ab 5d pop ebp

24 00a714ac c3 ret

Sorts the output by address:

0:000> uf /o @eip

Fibo!wmain [c:\development\my tools\fibo\fibo\fibo.cpp @ 20]:

20 00a71440 55 push ebp

20 00a71441 8bec mov ebp,esp

20 00a71443 81ecc0000000 sub esp,0C0h

20 00a71449 53 push ebx

20 00a7144a 56 push esi

20 00a7144b 57 push edi

20 00a7144c 8dbd40ffffff lea edi,[ebp-0C0h]

20 00a71452 b930000000 mov ecx,30h

20 00a71457 b8cccccccc mov eax,0CCCCCCCCh

20 00a7145c f3ab rep stos dword ptr es:[edi]

21 00a7145e 8bf4 mov esi,esp

21 00a71460 a19882a700 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (00a78298)]

21 00a71465 50 push eax

21 00a71466 6a00 push 0

21 00a71468 6a05 push 5

21 00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

21 00a7146f 83c408 add esp,8

21 00a71472 8bfc mov edi,esp

21 00a71474 50 push eax

21 00a71475 8b0d9082a700 mov ecx,dword ptr [Fibo!_imp_?coutstd (00a78290)]

21 00a7147b ff159482a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (00a78294)]

21 00a71481 3bfc cmp edi,esp

21 00a71483 e8d1fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

21 00a71488 8bc8 mov ecx,eax

21 00a7148a ff159c82a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (00a7829c)]

21 00a71490 3bf4 cmp esi,esp

21 00a71492 e8c2fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

23 00a71497 33c0 xor eax,eax

24 00a71499 5f pop edi

24 00a7149a 5e pop esi

24 00a7149b 5b pop ebx

24 00a7149c 81c4c0000000 add esp,0C0h

24 00a714a2 3bec cmp ebp,esp

24 00a714a4 e8b0fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

24 00a714a9 8be5 mov esp,ebp

24 00a714ab 5d pop ebp

24 00a714ac c3 ret

Creates linked call lines for accessing call information and creating breakpoints:

0:000> uf /O @eip

Fibo!wmain [c:\development\my tools\fibo\fibo\fibo.cpp @ 20]:

20 00a71440 55 push ebp

20 00a71441 8bec mov ebp,esp

20 00a71443 81ecc0000000 sub esp,0C0h

20 00a71449 53 push ebx

20 00a7144a 56 push esi

20 00a7144b 57 push edi

20 00a7144c 8dbd40ffffff lea edi,[ebp-0C0h]

20 00a71452 b930000000 mov ecx,30h

20 00a71457 b8cccccccc mov eax,0CCCCCCCCh

20 00a7145c f3ab rep stos dword ptr es:[edi]

21 00a7145e 8bf4 mov esi,esp

21 00a71460 a19882a700 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (00a78298)]

21 00a71465 50 push eax

21 00a71466 6a00 push 0

21 00a71468 6a05 push 5

21 00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

21 00a7146f 83c408 add esp,8

21 00a71472 8bfc mov edi,esp

21 00a71474 50 push eax

21 00a71475 8b0d9082a700 mov ecx,dword ptr [Fibo!_imp_?coutstd (00a78290)]

21 00a7147b ff159482a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (00a78294)]

21 00a71481 3bfc cmp edi,esp

21 00a71483 e8d1fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

21 00a71488 8bc8 mov ecx,eax

21 00a7148a ff159c82a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (00a7829c)]

21 00a71490 3bf4 cmp esi,esp

21 00a71492 e8c2fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

23 00a71497 33c0 xor eax,eax

24 00a71499 5f pop edi

24 00a7149a 5e pop esi

24 00a7149b 5b pop ebx

24 00a7149c 81c4c0000000 add esp,0C0h

24 00a714a2 3bec cmp ebp,esp

24 00a714a4 e8b0fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

24 00a714a9 8be5 mov esp,ebp

24 00a714ab 5d pop ebp

24 00a714ac c3 ret

Displays the number of instructions in a routine:

0:000> uf /i @eip

37 instructions scanned

Fibo!wmain [c:\development\my tools\fibo\fibo\fibo.cpp @ 20]:

20 00a71440 55 push ebp

20 00a71441 8bec mov ebp,esp

20 00a71443 81ecc0000000 sub esp,0C0h

20 00a71449 53 push ebx

20 00a7144a 56 push esi

20 00a7144b 57 push edi

20 00a7144c 8dbd40ffffff lea edi,[ebp-0C0h]

20 00a71452 b930000000 mov ecx,30h

20 00a71457 b8cccccccc mov eax,0CCCCCCCCh

20 00a7145c f3ab rep stos dword ptr es:[edi]

21 00a7145e 8bf4 mov esi,esp

21 00a71460 a19882a700 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (00a78298)]

21 00a71465 50 push eax

21 00a71466 6a00 push 0

21 00a71468 6a05 push 5

21 00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

21 00a7146f 83c408 add esp,8

21 00a71472 8bfc mov edi,esp

21 00a71474 50 push eax

21 00a71475 8b0d9082a700 mov ecx,dword ptr [Fibo!_imp_?coutstd (00a78290)]

21 00a7147b ff159482a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (00a78294)]

21 00a71481 3bfc cmp edi,esp

21 00a71483 e8d1fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

21 00a71488 8bc8 mov ecx,eax

21 00a7148a ff159c82a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (00a7829c)]

21 00a71490 3bf4 cmp esi,esp

21 00a71492 e8c2fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

23 00a71497 33c0 xor eax,eax

24 00a71499 5f pop edi

24 00a7149a 5e pop esi

24 00a7149b 5b pop ebx

24 00a7149c 81c4c0000000 add esp,0C0h

24 00a714a2 3bec cmp ebp,esp

24 00a714a4 e8b0fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

24 00a714a9 8be5 mov esp,ebp

24 00a714ab 5d pop ebp

24 00a714ac c3 ret

Special Command—Using # to Find Patterns of Assembly Instructions

Roberto Farah — Fri, 23 Oct 2009 14:46:00 GMT

Sometimes you need to look for patterns of disassembled code. You can browse the disassembled code and manually look for a specific pattern, or you can use a command to automate it. The # command does that.

# [Pattern] [Address [L Size ]]

Parameters:

Pattern - Specifies the pattern to search for in the disassembly code. If you have previously used the # command and you omit Pattern, the command reuses the most recently used pattern.

Address - Specifies the address where the search begins.

Size - Specifies the number of instructions to search. If you omit Size, the search continues until the first match occurs.

To demonstrate this command, let’s use this simple Visual C++ application that recursively calculates the Fibonacci from a specific number:

#include "stdafx.h"

using namespace std;

// Recursive function.

unsigned FiboRecursive(unsigned n, int nNum = 0)

{

if(n <= 1)

{

return n;

}

return FiboRecursive(n - 1, 1) + FiboRecursive(n - 2, 2);

}

int _tmain(int argc, _TCHAR* argv[])

{

cout << FiboRecursive(5) << endl;

return 0;

}

Let’s break the execution when the only line from main() is being executed, using a breakpoint for that.

Now let’s disassemble the eip register.

0:000> uf @eip

Fibo!wmain [c:\development\my tools\book\fibo\fibo\fibo.cpp @ 20]:

20 00a71440 55 push ebp

20 00a71441 8bec mov ebp,esp

20 00a71443 81ecc0000000 sub esp,0C0h

20 00a71449 53 push ebx

20 00a7144a 56 push esi

20 00a7144b 57 push edi

20 00a7144c 8dbd40ffffff lea edi,[ebp-0C0h]

20 00a71452 b930000000 mov ecx,30h

20 00a71457 b8cccccccc mov eax,0CCCCCCCCh

20 00a7145c f3ab rep stos dword ptr es:[edi]

21 00a7145e 8bf4 mov esi,esp

21 00a71460 a19882a700 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (00a78298)]

21 00a71465 50 push eax

21 00a71466 6a00 push 0

21 00a71468 6a05 push 5

21 00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

21 00a7146f 83c408 add esp,8

21 00a71472 8bfc mov edi,esp

21 00a71474 50 push eax

21 00a71475 8b0d9082a700 mov ecx,dword ptr [Fibo!_imp_?coutstd (00a78290)]

21 00a7147b ff159482a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (00a78294)]

21 00a71481 3bfc cmp edi,esp

21 00a71483 e8d1fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

21 00a71488 8bc8 mov ecx,eax

21 00a7148a ff159c82a700 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (00a7829c)]

21 00a71490 3bf4 cmp esi,esp

21 00a71492 e8c2fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

23 00a71497 33c0 xor eax,eax

24 00a71499 5f pop edi

24 00a7149a 5e pop esi

24 00a7149b 5b pop ebx

24 00a7149c 81c4c0000000 add esp,0C0h

24 00a714a2 3bec cmp ebp,esp

24 00a714a4 e8b0fcffff call Fibo!ILT+340(__RTC_CheckEsp) (00a71159)

24 00a714a9 8be5 mov esp,ebp

24 00a714ab 5d pop ebp

24 00a714ac c3 ret

Using the command below we’re going to display the first occurrence of ret.

0:000> # ret 00a71440

Fibo!wmain+0x6c [c:\development\my tools\book\fibo\fibo\fibo.cpp @ 24]:

00a714ac c3 ret

Looking for another pattern:

0:000> # call*Fibo!ILT 00a71440

Fibo!wmain+0x2a [c:\development\my tools\book\fibo\fibo\fibo.cpp @ 21]:

00a7146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (00a7100a)

Now let’s look for push instructions in a specific module/executable:

0:000> lm

start end module name

00a60000 00a7b000 Fibo C (private pdb symbols) C:\development\My Tools\Book\Fibo\Debug\Fibo.pdb

67350000 67473000 MSVCR90D (deferred)

690c0000 69197000 MSVCP90D (private pdb symbols) c:\publicsymbols\msvcp90d.i386.pdb\7B1C9137C0074A0E921BE874ADF944191\msvcp90d.i386.pdb

75e00000 75e44000 KERNELBASE (deferred)

75eb0000 75fb0000 kernel32 (deferred)

776c0000 77840000 ntdll (pdb symbols) c:\publicsymbols\wntdll.pdb\E06BEA155E9748BEA818E2D0DD2FED952\wntdll.pdb

0:000> # push 00a60000

Fibo!__ImageBase+0x40:

00a60040 0e push cs

As you can see, when looking for patterns in disassembled code “#” is the way to go! Here is an script that automates the process.

Tip: Most commands mentioned in the Special Commands section of this blog have a script that uses it and could serve as another example of using the command. Also there’re scripts that use commands from the SOS.DLL extension to debug managed code.

Check out the WinDbg Scripts and PowerDbg Scripts section.

Special Command—Tracing Applications Using wt

Roberto Farah — Mon, 12 Oct 2009 20:27:00 GMT

wt [WatchOptions] [= StartAddress] [EndAddress]

Transcribing the WinDbg documentation, this command runs through the whole function and then displays statistics when executed at the beginning of a function call. Thus, this command can be used just when doing live debugging, not post mortem debugging (dump analysis).

Think about Watch and Trace.

The WinDbg help file describes all options for WatchOptions. Usually we use the simplest form, not these options.

To demonstrate this command, let’s use this simple Visual C++ application that recursively calculates the Fibonacci from a specific number:

#include "stdafx.h"

using namespace std;

// Recursive function.

unsigned FiboRecursive(unsigned n, int nNum = 0)

{

if(n <= 1)

{

return n;

}

return FiboRecursive(n - 1, 1) + FiboRecursive(n - 2, 2);

}

int _tmain(int argc, _TCHAR* argv[])

{

cout << FiboRecursive(5) << endl;

return 0;

}

Now we run the application from WinDbg and insert a breakpoint in the beginning of _tmain().

After hitting the breakpoint, we disassemble the function:

0:000> uf Fibo!wmain

Fibo!wmain [c:\development\my tools\book\fibo\fibo\fibo.cpp @ 20]:

20 001b1440 55 push ebp

20 001b1441 8bec mov ebp,esp

20 001b1443 81ecc0000000 sub esp,0C0h

20 001b1449 53 push ebx

20 001b144a 56 push esi

20 001b144b 57 push edi

20 001b144c 8dbd40ffffff lea edi,[ebp-0C0h]

20 001b1452 b930000000 mov ecx,30h

20 001b1457 b8cccccccc mov eax,0CCCCCCCCh

20 001b145c f3ab rep stos dword ptr es:[edi]

21 001b145e 8bf4 mov esi,esp

21 001b1460 a198821b00 mov eax,dword ptr [Fibo!_imp_?endlstdYAAAV?$basic_ostreamDU?$char_traitsDstd (001b8298)]

21 001b1465 50 push eax

21 001b1466 6a00 push 0

21 001b1468 6a05 push 5

21 001b146a e89bfbffff call Fibo!ILT+5(?FiboRecursiveYAIIHZ) (001b100a)

21 001b146f 83c408 add esp,8

21 001b1472 8bfc mov edi,esp

21 001b1474 50 push eax

21 001b1475 8b0d90821b00 mov ecx,dword ptr [Fibo!_imp_?coutstd (001b8290)]

21 001b147b ff1594821b00 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01IZ (001b8294)]

21 001b1481 3bfc cmp edi,esp

21 001b1483 e8d1fcffff call Fibo!ILT+340(__RTC_CheckEsp) (001b1159)

21 001b1488 8bc8 mov ecx,eax

21 001b148a ff159c821b00 call dword ptr [Fibo!_imp_??6?$basic_ostreamDU?$char_traitsDstdstdQAEAAV01P6AAAV01AAV01ZZ (001b829c)]

21 001b1490 3bf4 cmp esi,esp

21 001b1492 e8c2fcffff call Fibo!ILT+340(__RTC_CheckEsp) (001b1159)

23 001b1497 33c0 xor eax,eax

24 001b1499 5f pop edi

24 001b149a 5e pop esi

24 001b149b 5b pop ebx

24 001b149c 81c4c0000000 add esp,0C0h

24 001b14a2 3bec cmp ebp,esp

24 001b14a4 e8b0fcffff call Fibo!ILT+340(__RTC_CheckEsp) (001b1159)

24 001b14a9 8be5 mov esp,ebp

24 001b14ab 5d pop ebp

24 001b14ac c3 ret

Let’s use the address right before the recursive function call as the Start address and the address right after it as the End address of wt. Note the “=” right before the first address.

0:000> wt =001b1468 001b146f

2 0 [ 0] Fibo!wmain

1 0 [ 1] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

64 0 [ 1] Fibo!FiboRecursive

1 0 [ 2] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

64 0 [ 2] Fibo!FiboRecursive

1 0 [ 3] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

64 0 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

64 0 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 5] Fibo!FiboRecursive

1 0 [ 6] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 6] Fibo!_RTC_CheckEsp

70 3 [ 5] Fibo!FiboRecursive

71 74 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 5] Fibo!FiboRecursive

1 0 [ 6] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 6] Fibo!_RTC_CheckEsp

70 3 [ 5] Fibo!FiboRecursive

79 148 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 5] Fibo!_RTC_CheckEsp

82 151 [ 4] Fibo!FiboRecursive

71 234 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 5] Fibo!_RTC_CheckEsp

70 3 [ 4] Fibo!FiboRecursive

79 308 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 4] Fibo!_RTC_CheckEsp

82 311 [ 3] Fibo!FiboRecursive

71 394 [ 2] Fibo!FiboRecursive

1 0 [ 3] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

64 0 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 5] Fibo!_RTC_CheckEsp

70 3 [ 4] Fibo!FiboRecursive

71 74 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 5] Fibo!_RTC_CheckEsp

70 3 [ 4] Fibo!FiboRecursive

79 148 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 4] Fibo!_RTC_CheckEsp

82 151 [ 3] Fibo!FiboRecursive

79 628 [ 2] Fibo!FiboRecursive

1 0 [ 3] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 3] Fibo!_RTC_CheckEsp

82 631 [ 2] Fibo!FiboRecursive

71 714 [ 1] Fibo!FiboRecursive

1 0 [ 2] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

64 0 [ 2] Fibo!FiboRecursive

1 0 [ 3] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

64 0 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 5] Fibo!_RTC_CheckEsp

70 3 [ 4] Fibo!FiboRecursive

71 74 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 4] Fibo!FiboRecursive

1 0 [ 5] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 5] Fibo!_RTC_CheckEsp

70 3 [ 4] Fibo!FiboRecursive

79 148 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 4] Fibo!_RTC_CheckEsp

82 151 [ 3] Fibo!FiboRecursive

71 234 [ 2] Fibo!FiboRecursive

1 0 [ 3] Fibo!ILT+5(?FiboRecursiveYAIIHZ)

67 0 [ 3] Fibo!FiboRecursive

1 0 [ 4] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 4] Fibo!_RTC_CheckEsp

70 3 [ 3] Fibo!FiboRecursive

79 308 [ 2] Fibo!FiboRecursive

1 0 [ 3] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 3] Fibo!_RTC_CheckEsp

82 311 [ 2] Fibo!FiboRecursive

79 1108 [ 1] Fibo!FiboRecursive

1 0 [ 2] Fibo!ILT+340(__RTC_CheckEsp)

2 0 [ 2] Fibo!_RTC_CheckEsp

82 1111 [ 1] Fibo!FiboRecursive

1196 instructions were executed in 1195 events (0 from other threads)

Function Name Invocations MinInst MaxInst AvgInst

Fibo!FiboRecursive 15 70 82 75

Fibo!ILT+340(__RTC_CheckEsp) 15 1 1 1

Fibo!ILT+5(?FiboRecursiveYAIIHZ) 15 1 1 1

Fibo!_RTC_CheckEsp 15 2 2 2

Fibo!wmain 1 2 2 2

0 system calls were executed

eax=00000005 ebx=7efde000 ecx=00000000 edx=00000001 esi=00000000 edi=00000000

eip=001b146f esp=0045f914 ebp=0045f964 iopl=0 nv up ei pl zr na pe nc

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246

Fibo!wmain+0x2f:

001b146f 83c408 add esp,8

Notice that the first number right below the command specifies the number of instructions that were executed, the second number specifies the number of instructions executed by child calls of the function, and the third number (in brackets) is the depth of the function in the stack.

MinInst, MaxInst and AvgInst mean the number of instructions by call.

Special Command—Saving Modules Using .writemem

Roberto Farah — Wed, 23 Sep 2009 02:00:00 GMT

This command enables you to save memory into a disk file. The cool thing about it is that you can save modules too; however, it is just the raw memory.

The parameters are:

.writemem <filename> <range>

Here is an example:

0:026> lm

start end module name

00400000 00427000 mtgdi (deferred)

5a700000 5acaf000 mfc90d (deferred)

63df0000 63f13000 MSVCR90D (deferred)

71270000 71283000 dwmapi (deferred)

72cf0000 72d70000 UxTheme (deferred)

73470000 73475000 MSIMG32 (deferred)

73b90000 73b9d000 MFC90ENU (deferred)

74fd0000 75053000 COMCTL32 (deferred)

751d0000 751dc000 CRYPTBASE (deferred)

751e0000 75240000 SspiCli (deferred)

75240000 75259000 sechost (deferred)

75260000 75ea6000 SHELL32 (deferred)

75ee0000 75f8c000 msvcrt (deferred)

75fd0000 76060000 GDI32 (deferred)

76150000 76250000 kernel32 (deferred)

76250000 762ed000 USP10 (deferred)

763b0000 76410000 IMM32 (deferred)

76410000 7649f000 OLEAUT32 (deferred)

764a0000 764e4000 KERNELBASE (deferred)

765c0000 766b0000 RPCRT4 (deferred)

766b0000 76733000 CLBCatQ (deferred)

76a00000 76aa0000 ADVAPI32 (deferred)

76ce0000 76d37000 SHLWAPI (deferred)

76f40000 77040000 USER32 (deferred)

77040000 7710c000 MSCTF (deferred)

77110000 7726b000 ole32 (deferred)

77640000 7764a000 LPK (deferred)

Now let’s save the MFC90ENU.DLL above.

0:026> .writemem c:\downloads\MFC90ENU.dll 73b90000 (73b9d000 - 0x1)

Writing d000 bytes..........................

Note the “- 0x1” above. If you don’t do that, the command will fail because the debugger will try to write from the base address to and including the end address.

Another approach you can use is to get the size of the module and use it as one of the parameters:

0:026> ? 73b9d000 - 73b90000

Evaluate expression: 53248 = 0000d000

0:026> .writemem c:\downloads\MFC90ENU.dll 73b90000 L 0000d000

Writing d000 bytes..........................

Special Command—Using .dump/.dumpcab to Get Dumps and Symbols from Production Servers

Roberto Farah — Wed, 16 Sep 2009 02:55:00 GMT

Using WinDbg you can create a dump file from an application running, for instance, in a production server. After collecting the dump file, you can load it in another machine and debug it. However, to be more effective during your debugging session you need symbols. Thus, thinking about it, here's the trick to get both dump and symbols.

First, to get a dump file with all information use it:

0:000> .dump /mfht c:\Test.dmp

Creating c:\Test.dmp - mini user dump

Dump successfully written

.dump has several arguments, but if you want a mini-dump with all information you just need to use:

/mfht

Where:

/m – This is to use options.

f – Adds full memory data to the minidump. All accessible committed pages owned by the target application will be included.

h – Adds data about the handles associated with the target application to the minidump.

t – Adds additional thread information to the minidump. This includes thread times, which can be displayed by using the !runaway extension or the .ttime command when debugging the minidump. (now you understand why your !runaway command failed that day, huh? :) )

Note: For more arguments check the WinDbg help file.

After collecting the dump file, open it from the production server using WinDbg and reload the symbols again.

Go to the command line and use the .dumpcab command.

The arguments for .dumpcab are –a (force all symbols) and the file name itself.

Here is how to do that:

0:003> .dumpcab -a c:\fulldump

Creating a cab file can take a VERY VERY long time

.Ctrl-C can only interrupt the command after a file has been added to the cab.

Adding C:\test.dmp - added

Adding c:\publicsymbols\wntdll.pdb\E06BEA155E9748BEA818E2D0DD2FED952\wntdll.pdb - added

Wrote c:\downloads\fulldump

After doing that the file FullDump.CAB will have the dump file and all related symbols, so you can transport it to your machine, unpack, load the dumps/symbols, and start debugging it!

Special Command—Using !chksym/!itoldyouso to Check PDB Files Against Modules

Roberto Farah — Fri, 04 Sep 2009 20:46:00 GMT

These are two debugger extensions that are used to see the PDB file that matches a specific module.

Note that !itoldyouso is not documented. The output of both commands is identical.

Usage:

0:025> !chksym ntdll

ntdll.dll

Timestamp: 49EEA706

SizeOfImage: 180000

pdb: wntdll.pdb

pdb sig: E06BEA15-5E97-48BE-A818-E2D0DD2FED95

age: 2

Loaded pdb is c:\publicsymbols\wntdll.pdb\E06BEA155E9748BEA818E2D0DD2FED952\wntdll.pdb

wntdll.pdb

pdb sig: E06BEA15-5E97-48BE-A818-E2D0DD2FED95

age: 2

MATCH: wntdll.pdb and ntdll.dll

0:025> !itoldyouso ntdll

ntdll.dll

Timestamp: 49EEA706

SizeOfImage: 180000

pdb: wntdll.pdb

pdb sig: E06BEA15-5E97-48BE-A818-E2D0DD2FED95

age: 2

Loaded pdb is c:\publicsymbols\wntdll.pdb\E06BEA155E9748BEA818E2D0DD2FED952\wntdll.pdb

wntdll.pdb

pdb sig: E06BEA15-5E97-48BE-A818-E2D0DD2FED95

age: 2

MATCH: wntdll.pdb and ntdll.dll

0:025> !chksym mtgdi

mtgdi.exe

Timestamp: 48785A80

SizeOfImage: 27000

pdb: c:\DOWNLOADS\mtgdi\Debug\mtgdi.pdb

pdb sig: EC1B3DB2-25C1-4337-8676-DFB3C5B1C8C9

age: 3

Loaded pdb is C:\development\My Tools\Book\mtgdi\Debug\mtgdi.pdb

mtgdi.pdb

pdb sig: EC1B3DB2-25C1-4337-8676-DFB3C5B1C8C9

age: 3

MATCH: mtgdi.pdb and mtgdi.exe

0:025> !itoldyouso mtgdi

mtgdi.exe

Timestamp: 48785A80

SizeOfImage: 27000

pdb: c:\DOWNLOADS\mtgdi\Debug\mtgdi.pdb

pdb sig: EC1B3DB2-25C1-4337-8676-DFB3C5B1C8C9

age: 3

Loaded pdb is C:\development\My Tools\Book\mtgdi\Debug\mtgdi.pdb

mtgdi.pdb

pdb sig: EC1B3DB2-25C1-4337-8676-DFB3C5B1C8C9

age: 3

MATCH: mtgdi.pdb and mtgdi.exe

Special Command—Displaying Information From Modules/DLLs with !dlls

Roberto Farah — Thu, 20 Aug 2009 05:10:00 GMT

!dlls extension displays the table entries of all loaded modules. You can also use it to display all modules that a specified thread or process is using.

The WinDbg help file describes all parameters. Here we are going to show the most common usage.

Displays file headers and section headers:

!dlls –a

0:801> !dlls –a

0x00543598: C:\development\My Tools\Book\mtgdi\Debug\MtGdi.exe

Base 0x00400000 EntryPoint 0x00411929 Size 0x00027000

Flags 0x00004000 LoadCount 0x0000ffff TlsIndex 0x00000000

LDRP_ENTRY_PROCESSED

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES

14C machine (i386)

6 number of sections

48785A80 time date stamp Sat Jul 12 00:17:20 2008

0 file pointer to symbol table

0 number of symbols

E0 size of optional header

103 characteristics

Relocations stripped

Executable

32 bit word machine

OPTIONAL HEADER VALUES

10B magic #

9.00 linker version

C400 size of code

7C00 size of initialized data

0 size of uninitialized data

11929 address of entry point

1000 base of code

1000 base of data

----- new -----

00400000 image base

1000 section alignment

200 file alignment

2 subsystem (Windows GUI)

5.00 operating system version

0.00 image version

5.00 subsystem version

27000 size of image

400 size of headers

0 checksum

00100000 size of stack reserve

00001000 size of stack commit

00100000 size of heap reserve

00001000 size of heap commit

00400100 Opt Hdr

0 [ 0] address [size] of Export Directory

23000 [ 8C] address [size] of Import Directory

25000 [ 1E7C] address [size] of Resource Directory

0 [ 0] address [size] of Exception Directory

0 [ 0] address [size] of Security Directory

0 [ 101] address [size] of Base Relocation Directory

1E940 [ 1C] address [size] of Debug Directory

0 [ 0] address [size] of Description Directory

0 [ 0] address [size] of Special Directory

0 [ 0] address [size] of Thread Storage Directory

0 [ 0] address [size] of Load Configuration Directory

0 [ 0] address [size] of Bound Import Directory

23884 [ 7F8] address [size] of Import Address Table Directory

0 [ 0] address [size] of Reserved Directory

SECTION HEADER #1

name

0 virtual size

0 virtual address

0 size of raw data

0 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

0 flags

(no align specified)

SECTION HEADER #2

name

0 virtual size

0 virtual address

0 size of raw data

0 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

0 flags

(no align specified)

SECTION HEADER #3

name

0 virtual size

0 virtual address

0 size of raw data

0 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

0 flags

(no align specified)

SECTION HEADER #4

name

0 virtual size

0 virtual address

0 size of raw data

0 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

0 flags

(no align specified)

SECTION HEADER #5

name

0 virtual size

0 virtual address

0 size of raw data

0 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

0 flags

(no align specified)

SECTION HEADER #6

name

0 virtual size

0 virtual address

0 size of raw data

0 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

0 flags

(no align specified)

Displays version numbers:

!dlls –v

0:801> !dlls -v

0x00543598: C:\development\My Tools\Book\mtgdi\Debug\MtGdi.exe

Base 0x00400000 EntryPoint 0x00411929 Size 0x00027000

Flags 0x00004000 LoadCount 0x0000ffff TlsIndex 0x00000000

LDRP_ENTRY_PROCESSED

Product Name MTGDI Application

Product Version 1, 0, 0, 1

Original Filename MTGDI.EXE

File Description MTGDI MFC Application

File Version 1, 0, 0, 1

0x00543628: C:\Windows\SysWOW64\ntdll.dll

Base 0x77630000 EntryPoint 0x00000000 Size 0x00180000

Flags 0x80004004 LoadCount 0x0000ffff TlsIndex 0x00000000

LDRP_IMAGE_DLL

LDRP_ENTRY_PROCESSED

Company Name Microsoft Corporation

Product Name Microsoft® Windows® Operating System

Product Version 6.1.7100.0

Original Filename ntdll.dll

File Description NT Layer DLL

File Version 6.1.7100.0 (winmain_win7rc.090421-1700)

0x005439a8: C:\Windows\syswow64\kernel32.dll

Base 0x769d0000 EntryPoint 0x769e3e8a Size 0x00100000

Flags 0x80084004 LoadCount 0x0000ffff TlsIndex 0x00000000

LDRP_IMAGE_DLL

LDRP_ENTRY_PROCESSED

LDRP_PROCESS_ATTACH_CALLED

Company Name Microsoft Corporation

Product Name Microsoft® Windows® Operating System

Product Version 6.1.7100.0

Original Filename kernel32

File Description Windows NT BASE API Client DLL

File Version 6.1.7100.0 (winmain_win7rc.090421-1700)

0x00543ac0: C:\Windows\syswow64\KERNELBASE.dll

Base 0x76ad0000 EntryPoint 0x76ad563f Size 0x00044000

Flags 0x80084004 LoadCount 0x0000ffff TlsIndex 0x00000000

LDRP_IMAGE_DLL

LDRP_ENTRY_PROCESSED

LDRP_PROCESS_ATTACH_CALLED

Company Name Microsoft Corporation

Product Name Microsoft® Windows® Operating System

Product Version 6.1.7100.0

Original Filename Kernelbase

File Description Windows NT BASE API Client DLL

File Version 6.1.7100.0 (winmain_win7rc.090421-1700)

Using Module Address to display information from a specific dll:

!dlls –c <moduleAddress>

0:801> !dlls -c 63390000

Dump dll containing 0x63390000:

0x00544998: C:\Windows\WinSxS\x86_microsoft.vc90.debugcrt_1fc8b3b9a1e18e3b_9.0.30729.1_none_bb1f6aa1308c35eb\MSVCR90D.dll

Base 0x63390000 EntryPoint 0x633cc6f0 Size 0x00123000

Flags 0x90084004 LoadCount 0x0000ffff TlsIndex 0x00000000

LDRP_IMAGE_DLL

LDRP_ENTRY_PROCESSED

LDRP_PROCESS_ATTACH_CALLED

LDRP_REDIRECTED

Special Command—Using !for_each_frame to Run Commands

Roberto Farah — Thu, 20 Aug 2009 05:07:00 GMT

!for_each_frame is a favorite among debuggers. It's a very flexible and powerful command that enables you to run commands for each frame of the call stack.

You can use basically any command.

For instance, let’s say you want to see all local variables from each frame of a specific stack. Of course, to see local variables you must have private symbols.

0:025> !for_each_frame dv /i /t /V

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

00 0532fcd0 776f8edc ntdll!NtWaitForSingleObject+0x15

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

01 0532fd34 776f8dc0 ntdll!RtlpWaitOnCriticalSection+0x13e

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

02 0532fd5c 00414ee7 ntdll!RtlEnterCriticalSection+0x150

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

03 0532fdc8 00414834 mtgdi!CBallThread::SingleStep+0x147 [c:\downloads\mtgdi\threads.cpp @ 180]

prv local 0532fdc4 @ebp-0x04 class CBallThread * this = 0x043349f0

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

04 0532fe20 00414d8c mtgdi!CGDIThread::InitInstance+0x44 [c:\downloads\mtgdi\threads.cpp @ 65]

prv local 0532fe1c @ebp-0x04 class CGDIThread * this = 0x043349f0

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

05 0532fe78 5a67d3e3 mtgdi!CBallThread::InitInstance+0x2c [c:\downloads\mtgdi\threads.cpp @ 156]

prv local 0532fe74 @ebp-0x04 class CBallThread * this = 0x043349f0

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

06 0532ff40 6d97dfd3 mfc90d!_AfxThreadEntry+0x303

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

07 0532ff7c 6d97df69 MSVCR90D!_callthreadstartex+0x53

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

08 0532ff88 75ec3f39 MSVCR90D!_threadstartex+0x89

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

09 0532ff94 77710409 kernel32!BaseThreadInitThunk+0xe

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

0a 0532ffd4 777103dc ntdll!__RtlUserThreadStart+0x70

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

0b 0532ffec 00000000 ntdll!_RtlUserThreadStart+0x1b

Unable to enumerate locals, HRESULT 0x80004005

Private symbols (symbols.pri) are required for locals.

Type ".hh dbgerr005" for details.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

00 0532fcd0 776f8edc ntdll!NtWaitForSingleObject+0x15