Getting an exception call stack from the catch block (C++)

re: Getting an exception call stack from the catch block (C++)

Pavel Lebedinsky — Mon, 31 Jan 2005 00:40:00 GMT

How did you find the 000af954 value? Is it because it's the next slot on the stack after what looks like the address that the catch block will return to?

000af954 000af980
000af958 7c3929b5 MSVCR80!_CallCatchBlock2+0x4a

By the way, there's more information about .cxr and the magical 0x1003f and 0x1001f numbers in the Mike Stall's blog:

http://blogs.msdn.com/jmstall/archive/2005/01/18/355697.aspx

re: Getting an exception call stack from the catch block (C++)

applebean — Mon, 31 Jan 2005 11:12:00 GMT

I am also interested for the value 000af954. I wrote the sample code and debugged locally also, the pattern is different. Could you explain a little more?

re: Getting an exception call stack from the catch block (C++)

Slava Oks — Mon, 31 Jan 2005 19:42:00 GMT

Yes. It appeared to be the first valid frame. So you can do two things here one is to set ebp to it and see if it works or the other way is run kb=000af954

>>By the way, there's more information about .cxr and the magical 0x1003f and 0x1001f numbers in the Mike Stall's blog:

>>http://blogs.msdn.com/jmstall/archive/2005/01/18/355697.aspx Remove Comment 363443

That is a good point. I saw the post couple of days ago and that is exact reason why I didn't go into details of the magic :-). I forgot to put a pointer. Thank you very much for reminder!

re: Getting an exception call stack from the catch block (C++)

Slava Oks — Mon, 31 Jan 2005 19:48:00 GMT

>> I am also interested for the value 000af954. I wrote the sample code and debugged locally also, the pattern is different. Could you explain a little more?

Yes in you case it will be different. You need to be looking at your thread stack. If you run dps @esp as I did above the first column is thread's stack. The second column is what is stored on the stack. Usually a stack frame contains both address to previous frame and return address. All I did is looked for the pattern that seems to be a valid frame and then tried it. Let me know if you want me to dig more information out for you about how frames getting set and how to traverse them by hand.

Interesting finds today

Jason Haley — Tue, 01 Feb 2005 04:49:00 GMT

Interesting finds today

re: Getting an exception call stack from the catch block (C++)

Bart Duncan — Tue, 01 Mar 2005 08:16:00 GMT

A call of a function pushes the return value on the stack first, followed by ebp.

When looking at dps/dds output you can identify a likely frame start by looking for a pointer that points to an address just a bit down the stack that could be a valid pushed ebp, followed by what looks like a valid return address. This matches that pattern:

000af954 000af980
000af958 7c3929b5 MSVCR80!_CallCatchBlock2+0x4a

You can pass the address of the likely ebp to the k command (kv=000af954) to start a stack walk at that point. This is also a useful trick to recover the second half of a stack that is truncated due to an FPO frame in a module that you don't have symbols for.

re: Getting an exception call stack from the catch block (C++)

Useful blog — Wed, 22 Feb 2006 14:31:48 GMT

Very useful blog. Thank you.

re: Getting an exception call stack from the catch block (C++)

Feng Tian — Thu, 11 May 2006 02:51:18 GMT

Anyone knows the AMD64 counterpart of the magical 0001003f?

Windows C++ Exception Handling

MikeKelly's WebLog — Thu, 11 Oct 2007 20:19:33 GMT

Good post on how to see the stack when an exception is thrown on Windows at http://blogs.msdn.com/slavao/archive/2005/01/30/363428.asp

Boxing » Blog Archive » MikeKelly’s WebLog

Boxing » Blog Archive » MikeKelly’s WebLog — Sun, 06 Jan 2008 06:17:10 GMT

PingBack from http://boxing.247blogging.info/?p=3202

La billeterie » Blog Archive » Analyse mémoire sous windows

La billeterie » Blog Archive » Analyse mémoire sous windows — Wed, 22 Apr 2009 11:54:28 GMT

PingBack from http://jmdesp.free.fr/billeterie/?p=168

Slava Oks s WebLog Getting an exception call stack from the catch | Wood TV Stand

Wed, 03 Jun 2009 01:21:34 GMT

PingBack from http://woodtvstand.info/story.php?id=89954