1

The ".thread" command is used to change the thread context in Windows kernel debugging. MSDN

But I encountered the below situation:

  1. Execute the following two commands consecutively. The first command set thread context to ffffc08213599040, but it Actually still ffffc08229313080.
0: kd> .thread ffffc082`13599040          
Implicit thread is now ffffc082`13599040
0: kd> .thread
Implicit thread is now ffffc082`29313080   

2.Execute the following two commands consecutively. I want to change the rip of the thread ffffc08213599040, But command "r rip=xxx" failed.

0: kd> .thread ffffc082`13599040
Implicit thread is now ffffc082`13599040
0: kd> r rip = fffff803`3de6341d
Last set context:
                               ^ Bad register error in 'r rip = fffff803`3de6341d'

1 Answer 1

4

It works As Expected and Documented
Running a plain .thread resets context to CurrentThread as documented

Quote From Documentation  

Thread 
The address of the thread. If this is omitted or zero,   
the thread context is reset to the current thread.

You Cannot Set @rip to Arbitrary Values

2
  • Okay, I didn’t notice "If omitted or zero, The thread context will be reset to the current thread. " But why can't I use the command r to set the register value?
    – Ox9A82
    Jan 7, 2021 at 7:35
  • The rip value can be modified in windbg.
    – Ox9A82
    Jan 7, 2021 at 7:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.