0

I wonder why defining frame manually keeps failing on range error. As far as I understand the syntax is :

.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should be the next instruction after call OtherFunc, say in MyFunc+0x14.

And the stack looks like this

              MyFunc+0x14  
BASE/STACK -> ..
              ..
STACK/BASE -> ..
              RetFromMyFunc 

and STACK/BASE refer to those addresses in stack. I couldn't figure out which is which but tried both options and many others. Why does it fail? It is x64 of course.

Thanks.

1

Are You Providing all the three overrides
this command is for looking at locals of a different frame
this command will work better or correct with an application having its private pdb

here is a simulated range error look how esp,ebp,eip changes in register display

0:000> r
eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000
eip=77a005a6 esp=001af7f8 ebp=001af824 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
77a005a6 cc              int     3

0:000> .frame /c /r = @ebp+1000 @esp-0x1000 @eip+0x300

00 001b0824 00000000 ntdll!LdrpCheckAppDirType+0xa4
eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000
eip=77a008a6 esp=001ae7f8 ebp=001b0824 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpCheckAppDirType+0xa4:
77a008a6 7408            je      ntdll!LdrpCheckAppDirType+0xae (77a008b0) [br=1]

0:000> k
  *** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr
001b0824 00000000 ntdll!LdrpCheckAppDirType+0xa4

0:000> .cxr
Resetting default scope

0:000> k
ChildEBP RetAddr
001af824 779e0e00 ntdll!LdrpDoDebuggerBreak+0x2c
001af984 779c60a7 ntdll!LdrpInitializeProcess+0x11a9
001af9d4 779c3659 ntdll!_LdrpInitialize+0x78
001af9e4 00000000 ntdll!LdrInitializeThunk+0x10

0:000> .frame /c /r = @ebp+1000 @esp-0x1000
                                           ^ Range error in '.frame /c /r = @ebp+1000 @esp-0x1000 '

0:000> .frame /c /r = @ebp+1000 @esp-0x1000 @eip-500

00 001b0824 00000000 ntdll!LdrpLogDllRelocationEtwEvent+0x77
eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000
eip=77a000a6 esp=001ae7f8 ebp=001b0824 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpLogDllRelocationEtwEvent+0x77:
77a000a6 7f83            jg      ntdll!LdrpCorProcessImports+0x25 (77a0002b) 
[br=0]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.