Debugger commands (stack frame navigation) that makes my life easier

  • Article

One thing that I have always found clunky is stack frame navigation in windbg/kd.
Previously, I thought you had only a couple of options.

The first option, if you are using WinDBG, is that
you can bring up the call stack window. I have found that this is not a great
thing to do b/c WinDBG will try to update the call stack window while the target
is running and not just when you are broken in (perhaps it does this only for
module loads, I don't know). Of course, since this is WinDBG dependent, this does
not work in kd. As the final straw, this requires moving my hands off the keyboard,
losing valuable time navigating with the mouse ;).

The second option is to use the kn
command. This will dump the stack with frame numbers, the output looks like this:

 
1: kd> kn
 # ChildEBP RetAddr
00 81e33c6c 81898d7c nt!RtlpBreakWithStatusInstruction
01 81e33c74 81898d2e nt!KdCheckForDebugBreak+0x22
02 81e33d20 8183ddd5 nt!KeUpdateRunTime+0x270
03 81e33d50 8187dba2 nt!PopIdleDefaultHandler+0x239
04 81e33d54 00000000 nt!KiIdleLoop+0xa

And then you can issue the .frame N command,
where N is the frame number to navigate to that frame and start debugging

 
1: kd> .frame 3
03 81e33d50 8187dba2 nt!PopIdleDefaultHandler+0x239
1: kd> dv
[...]

My problem is that I didn't know how to do frame relative jumps, so every time
I wanted to move to a new frame I ran kn again
(since I forget the frame numbers), found the new frame and ran
.frame N with the new frame number. Well today I
saw 2 new ways how to navigate the frames.

The first way will work with the previous debugger releases. You use the pseudo register
$frame. Pretty nice trick IMO.

 
1: kd> .frame @$frame-1
02 81e33d20 8183ddd5 nt!KeUpdateRunTime+0x270
1: kd> .frame @$frame+1
03 81e33d50 8187dba2 nt!PopIdleDefaultHandler+0x239

The second way to navigate frames requires the debugger package that was just
released and is a little less cumbersome to use. There are 2 new debugger commands,
.f+ and .f-.
These are definitely easier to use in my book because I don't have to remember
the register deref syntax.

 
1: kd> .f-
02 81e33d20 8183ddd5 nt!KeUpdateRunTime+0x270
1: kd> .f+
03 81e33d50 8187dba2 nt!PopIdleDefaultHandler+0x239

With these new commands, I think I get now get by without having to lift my
hands off the keyboard ;).