How To Debug

The magic symbol path is SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

More useful command examples:

`x kernel32!Ctrl`	search for symbol
`~*kb`	dump stack of all threads
`bp 77e9658d "r eax=0;g"`	create breakpoint that executes command when hit
`bl`	list breakpoints
`u kernel32!CreateEventA`	disassemble

Push moves the stack pointer backward in memory (ie, esp -= 4) and then writes the given value to location pointed at by the stack pointer.

All arguments are widened to 32 bits when they are passed. Return values are also widened to 32 bits and returned in the eax register, except for 8-byte structures, which are returned in the edx:eax register pair. Larger structures are returned in the eax register as pointers to hidden return structures. Parameters are pushed onto the stack from right to left.

The compiler generates prolog and epilog code to save and restore the esi, edi, ebx, and ebp registers, if they are used in the function.

name	argument passing	stack cleanup	name decoration	`int func(int a, double b)`
cdecl	on stack, reverse order / right to left (`ebp+0x8` is param0, `ebp+0xC` is param1 ...)	caller	prefix: "_"	`_func`
stdcall	on stack, reverse order / right to left (`ebp+0x8` is param0, `ebp+0xC` is param1 ...)	callee	prefix: "_"; suffix: "@" followed by the number of bytes (in decimal) in the argument list.	`_func@12`
fastcall	The first two `DWORD` or smaller arguments are passed in `ecx` and `edx` registers; all other arguments are passed on stack, reverse order / right to left (`ebp+0x8` is param2, `ebp+0xC` is param3 ...)	callee	prefix: "@"; suffix: "@" followed by the number of bytes (in decimal) in the argument list.	`@func@12`
thiscall	`this` in `ecx`; all other arbuments are passed on stack, reverse order / right to left (`ebp+0x8` is param0, `ebp+0xC` is param1 ...);	callee	(C++ mangling)

__asm { int 3 }	hardcoded debug breakpoint
#define TEB_OFFSET 4 void ** ppvStackBase; __asm { mov eax, fs:[TEB_OFFSET] } __asm { mov ppvStackBase, eax }	stack base from TEB
void ** ppvFrame; _asm { mov ppvFrame, ebp }	frame pointer

Can you please explain us what is Frame Pointer Optimization (FPO)...... Also could you explain in detail about the Stacks and the ESP and EBP in the stacks with some simple examples. Would appreicate your help! Thanks Sriram Rajendran

2007-05-03 : Did the arguments to kernel32!UnhandledExceptionFilter change with Windows Server 2003 SP1? I'm seeing what appears to be the EXCEPTION_POINTERS structure in the *third* argument (the first arg is *not* on the stack, but is in the UnhandledExceptionFilter code.

For example: ChildEBP RetAddr Args to Child 056ae6d4 7c821b74 773d59cf 50000018 00000004 ntdll!KiFastSystemCallRet 056ae6d8 773d59cf 50000018 00000004 00000003 ntdll!NtRaiseHardError+0xc 056ae734 773bde9b 039ad9e0 042ece30 00012010 user32!ServiceMessageBox+0x145 056ae890 773b1a28 056ae89c 00000028 00000000 user32!MessageBoxWorker+0x13e 056ae8e8 773d5e47 00000000 039ad9e0 042ece30 user32!MessageBoxTimeoutW+0x7a 056ae91c 773bdd8b 00000000 056ae9c0 7c37f480 user32!MessageBoxTimeoutA+0x9c 056ae93c 773bd923 00000000 056ae9c0 7c37f480 user32!MessageBoxExA+0x1b 056ae958 7c34c224 00000000 056ae9c0 7c37f480 user32!MessageBoxA+0x45 056ae98c 7c348e6c 056ae9c0 7c37f480 00212010 msvcr71!__crtMessageBoxA+0xf4 056aeba8 7c34cf83 0000000a 056aef34 056af2a8 msvcr71!_NMSG_WRITE+0x12e 056aebe0 77e99e3a 056af2a8 201c5688 03724df0 msvcr71!abort+0x7 056aebd8 7c35f0a8 7c35f07d 77e99e3a 056af2a8 kernel32!UnhandledExceptionFilter+0x14d 056aebe4 056af2a8 201c5688 03724df0 056affa8 msvcr71!__CxxUnhandledExceptionFilter+0x2b WARNING: Frame IP not in any known module. Following frames may be wrong. 056af264 201bc619 056af2a8 00000000 056affa8 0x56af2a8 056af27c 201b75a6 e06d7363 056af2a8 201b792f usercode!DllUnregisterServer+0xb177 056affb8 77e6608b 03724df0 00000000 00000000 usercode!DllUnregisterServer+0x6104 056affec 00000000 201b7518 03724df0 00000000 kernel32!BaseThreadStart+0x34
-- Ray Bloom

2007-05-04 : I agree, the third parameter (056af2a8) looks like the address of the EXCEPTION_POINTERS struct (it's on the stack, and it's passed along to other functions). I don't know whether kernel32!UnhandledExceptionFilter has changed in Win 2003 Srv. It could have, but it seems like that might cause compatibility problems. My guess is that you are seeing some FPO funkiness. 7c35f0a8, 7c35f07d, and 77e99e3a all look like return addresses to me.
-- Louis! :)