CODEWITHSUNDEEP
cwindowswindbg
IGP
IGP

Reputation: 67

Is there any way to display all the functions called by an executable in WinDBG (not just call stack)?

I am trying to debug an executable that does not work properly (does not receive segmentation fault, it just doesn't do what he should do) using WinDbg. I would like to see a call stack with all the functions that are called while running the executable. Is this possible in WinDbg or any other debugger?

Upvotes: 2

Views: 2325

Answers (1)

blabb
blabb

Reputation: 9007

yes as i commented use wt (watch and trace)
Read the docs it can be configured in several ways
like only first level calls
upto nth level calls only
only in specific modules
only in main module etc

below is a simple trace of a function in ntdll that crosses um-km boundary

0:000> u . l1
ntdll!LdrpInitializeProcess+0x11bf:
76ff6113 e870fffdff      call    ntdll!NtQueryInformationProcess (76fd6088)

0:000> bp .+5  //set a bp on return address
0:000> bl
 0 e 76ff6118     0001 (0001)  0:**** ntdll!LdrpInitializeProcess+0x11c4

0:000> wt
    2     0 [  0] ntdll!NtQueryInformationProcess
   27     0 [  0] aswhook
    1     0 [  1]   aswhook
   28     1 [  0] aswhook
    1     0 [  1]   0x6efc0480
    1     0 [  1]   0x6efc0485
    2     0 [  1]   ntdll!NtQueryInformationProcess
    2     0 [  2]     ntdll!KiFastSystemCall
    1     0 [  1]   ntdll!NtQueryInformationProcess
   46     8 [  0] aswhook
    3     0 [  1]   aswhook

Breakpoint 0 hit
eax=00000000 ebx=7ffdf000 ecx=e8cb8789 edx=ffffffff esi=ffffffff edi=00000000
eip=76ff6118 esp=0018f59c ebp=0018f6f4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpInitializeProcess+0x11c4:
76ff6118 85c0            test    eax,eax
0:000>

Upvotes: 2

Related Questions