1

I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. Here is my attempt.

nt!DbgBreakPointWithStatus:
fffff807`0d3c9cc0 cc              int     3
2: kd> .call WdFilter!SwitchToPanicMode(0,0)
                                           ^ Syntax error in '.call WdFilter!SwitchToPanicMode(0,0)'
2: kd> bp nt!EtwTracePageFault
2: kd> .call WdFilter!SwitchToPanicMode(this,0,0)
                                                ^ Syntax error in '.call WdFilter!SwitchToPanicMode(this,0,0)'
2: kd> .call /v nt!EtwTracePageFault(this,0x0)
                                             ^ Syntax error in '.call /v nt!EtwTracePageFault(this,0x0)'
2: kd> .call /v WdFilter!SwitchToPanicMode(this,0x0,0x0)
                                                       ^ Syntax error in '.call /v WdFilter!SwitchToPanicMode(this,0x0,0x0)'
2: kd> x /d /t nt!EtwTracePageFault

Suppose I have known that function SwitchToPanicMode takes in 2 function arguments, which .call format should I use to manually trigger the function? Or is there any way that can get around(maybe like use !analyze -v when the program crashes)?

Improve this question
2
  • 1
    Afaik .call is user mode live debugging only it doesnt work in kd or crash dumps
    – blabb
    Jul 12 at 10:17
  • @blabb I think I have found the function. But changing the RIP directly to the function's address and use command g won't trigger the function. I looked up the answer here. It says I need a different address because ntdll!DbgBreakPoint is in user mode. Not sure how to get the address.
    – anonymous bear
    Jul 16 at 3:18

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.