It works As Expected and Documented
Running a plain .thread resets context to CurrentThread as documented
Quote From Documentation
The address of the thread. If this is omitted or zero,
the thread context is reset to the current thread.
You Cannot Set @rip to Arbitrary Values
can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ?
if that is the case then it means you allocate memory etc just after windbg/cdb broke on System Breakpoint
if you are doing .dvalloc when you are on System Breakpoint then HttpRequestA might cause the block
go to the ...
as i commented in latest windows type index has been randomised
it is a xor of the index with nt!obHeaderCookie and the second byte of OBJECT_HEADER Address
0: kd> ?? (char *)@$proc->ImageFileName
char * 0xffffa083`398ab4d0
0: kd> ?? ((nt!_object_header *) @@masm( @$proc - @@c++(#FIELD_OFFSET(nt!_OBJECT_HEADER , ...
the rva does not seem to point to _tagSTACKFRAME64 the size appears to be different
0x108 versus 0x4d0
is there a specific reason to use dbghelp ?
outputstacktrace from dbgeng is not acceptable?
have you looked at the com interfaces of DIA_SDK for an alternative
checked an arbitrary dump for sizeof(_tagStackFrame) versus size in dump using code below
I am not sure what you are asking (never used sticky notes and don't have it installed )
but if you want to run sticky notes from command line you can do something like this
the command below will run calculator instead of the wildcard calc use stick
C:\>powershell -c "(get-startapps -name *calc*).Appid
The earliest break is sxe ibp break on kd communication
if you want to break earlier than that you need to lookup boot debugging
you can use ctrl+alt+d for a debug spew of kdcom kdnet packets sent to and fro
Are You Providing all the three overrides
this command is for looking at locals of a different frame
this command will work better or correct with an application having its private pdb
here is a simulated range error look how esp,ebp,eip changes in register display
eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000
During my analysis I use Floss!, it is an excellent tool and super simple to use, on several occasions I can find the strings I am looking for, you used PEID to check for packers please use a more up-to-date tool like DIE (Detect it Easy), if it is an .EXE file consider analyzing with a professional and updated debbuger like x96DBG(x64dbg/x32dbg), I believe ...