开发者

Why won't windbg disassemble half of my function?

开发者 https://www.devze.com 2023-04-01 22:16 出处:网络
Background: I\'m using windbg to diagnose causes from minidumps from Microsoft\'s WinQual service. I\'ve taken the time to set things up properly with PDBs and binaries in the same path location as wh

Background: I'm using windbg to diagnose causes from minidumps from Microsoft's WinQual service. I've taken the time to set things up properly with PDBs and binaries in the same path location as when they were built, and I've had very good luck with windbg and this setup.

Today I ran across a minidump where I'd really like to look through the disassembly to understand the problem, but windbg will only reverse a section of the function.

My function looks like this:

SomeStruct* STDCALL getThing(int id)
{
    S_ASSERT(a);
    S_ASSERT(b);
    S_ASSERT(c);
    SomeStruct* result = fn(id);
    S_ASSERT(d);
    return result;
}

S_ASSERT is our macro which eventually calls into a function, where the int 3 instruction is hit, even in release builds. I just can't tell which one was hit without inspecting the disassembly.

Using windbg, I can jump to getThingin the call stack, activate disassembly and see some code, but can't scroll back in the disassembly. I then added a watch on module!getThing to get the function address, and wrote that address in the disassembly window. Instead of instructions, I get ~100 lines of ??? followed by some disassembly which does not look like the function entry point but does look like part of the correct function. It looks like this:

No prior disassembly possible
module!getThing:
1d7d4aa0 ??              ???
1d7d4aa1 ??              ???
1d7d4aa2 ??              ???
...
1d7d4b0a 087d1c          or      byte ptr [ebp+1Ch],bh
1d7d4b0d 8b4004          mov     eax,dword ptr [eax+4]
1d7d4b10 8bf9            mov     edi,ecx
1d7d4b12 83e11f          and     ecx,1Fh
1d7d4b15 bb01000000      mov     ebx,1
...

So, how can I convince windbg to show the rest of the disassembly? Alternately, am I misinterpreting the results? Is there some oth开发者_开发知识库er software able to load minidumps aside from Visual Studio?

Thank you for any insight you can provide!


Make sure that you have a copy of the same dll or exe in the symbol path (.sympath) or the exe path (.exepath). Use !sym noisy and .reload and verify that windbg finds this dll.

0

精彩评论

暂无评论...
验证码 换一张
取 消