Return to Question

added 7 characters in body

Source Link

edited Feb 10, 2021 at 17:24

I wonder why defining frame manually keeps failing on range error. As far as I understand the syntax is :

.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should be the next instruction after call OtherFunc, say in MyFunc+0x14.

And the stack looks like this

              MyFunc+0x14  
BASE/STACK -> ..
              ..
STACK/BASE -> ..
              MyFuncRetFromMyFunc

and STACK/BASE refer to those addresses in stack. I couldn't figure out which is which but tried both options and many others. Why does it fail? It is x64 of course.

Thanks.

I wonder why defining frame manually keeps failing on range error. As far as I understand the syntax is :

.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should be the next instruction after call OtherFunc, say in MyFunc+0x14.

And the stack looks like this

              MyFunc+0x14  
BASE/STACK -> ..
              ..
STACK/BASE -> ..
              MyFunc

and STACK/BASE refer to those addresses in stack. I couldn't figure out which is which but tried both options and many others. Why does it fail? It is x64 of course.

Thanks.

I wonder why defining frame manually keeps failing on range error. As far as I understand the syntax is :

.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should be the next instruction after call OtherFunc, say in MyFunc+0x14.

And the stack looks like this

              MyFunc+0x14  
BASE/STACK -> ..
              ..
STACK/BASE -> ..
              RetFromMyFunc

and STACK/BASE refer to those addresses in stack. I couldn't figure out which is which but tried both options and many others. Why does it fail? It is x64 of course.

Thanks.

Source Link

asked Feb 8, 2021 at 17:06

eyal karni

Defining frame manually windbg

I wonder why defining frame manually keeps failing on range error. As far as I understand the syntax is :

.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should be the next instruction after call OtherFunc, say in MyFunc+0x14.

And the stack looks like this

              MyFunc+0x14  
BASE/STACK -> ..
              ..
STACK/BASE -> ..
              MyFunc

and STACK/BASE refer to those addresses in stack. I couldn't figure out which is which but tried both options and many others. Why does it fail? It is x64 of course.

Thanks.

windbg