I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. Here is my attempt.

fffff807`0d3c9cc0 cc              int     3
2: kd> .call WdFilter!SwitchToPanicMode(0,0)
                                           ^ Syntax error in '.call WdFilter!SwitchToPanicMode(0,0)'
2: kd> bp nt!EtwTracePageFault
2: kd> .call WdFilter!SwitchToPanicMode(this,0,0)
                                                ^ Syntax error in '.call WdFilter!SwitchToPanicMode(this,0,0)'
2: kd> .call /v nt!EtwTracePageFault(this,0x0)
                                             ^ Syntax error in '.call /v nt!EtwTracePageFault(this,0x0)'
2: kd> .call /v WdFilter!SwitchToPanicMode(this,0x0,0x0)
                                                       ^ Syntax error in '.call /v WdFilter!SwitchToPanicMode(this,0x0,0x0)'
2: kd> x /d /t nt!EtwTracePageFault

Suppose I have known that function SwitchToPanicMode takes in 2 function arguments, which .call format should I use to manually trigger the function? Or is there any way that can get around(maybe like use !analyze -v when the program crashes)?

  • 1
    Afaik .call is user mode live debugging only it doesnt work in kd or crash dumps
    – blabb
    Commented Jul 12, 2023 at 10:17
  • @blabb I think I have found the function. But changing the RIP directly to the function's address and use command g won't trigger the function. I looked up the answer here. It says I need a different address because ntdll!DbgBreakPoint is in user mode. Not sure how to get the address. Commented Jul 16, 2023 at 3:18


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.