Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Sept/Oct 2019 Issue of The NT Insider available

Download PDF here:

It’s a particularly BIG issue, too: 40 pages of technical goodness, ranging from WDF to Minifilters. Check it out.
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

How to display the size value

Santhosh_Kumar-3Santhosh_Kumar-3 Member Posts: 125


I am returning to WinDbg after a 10-15 year break so pardon me for the basic question. I do know the size of systemHandles.size() = 7. How can I see that in Windbg Watch Window? thanks


  • raj_rraj_r Member - All Emails Posts: 981
    edited July 3

    @pgv i think there is a mail from me that is stuck in some queue
    @santosh_kumar std::vector->size() is a function i dont think watch windows can evaluate function results
    it can only typecast a memory location
    you can do dx systemHandles.size() using the new natvis expression evaluator it will provide you the vector size

    0:000> dv  
    g1 = { size=5 } 
    0:000> ?? g1 
    class std::vector<int,std::allocator > 
    +0x000 _Mypair : std::_Compressed_pair<std::allocator,std::_Vector_val<std::_Simple_types >,1> 
    0:000> dx g1.size() <<<<<<<<<<<<<<<<< 
    g1.size() : 5 <<<<<<<<<<<<<<<<<<< 

    0:000> dx -r 9 g1 
    g1 : { size=5 } [Type: std::vector<int,std::allocator >] 
    [] [Type: std::vector<int,std::allocator >] 
    [capacity] : 6 
    [allocator] : allocator [Type: std::_Compressed_pair<std::allocator,std::_Vector_val<std::_Simple_types >,1>] 
    [] [Type: std::_Compressed_pair<std::allocator,std::_Vector_val<std::_Simple_types >,1>] 
    [0] : 1 [Type: int] 
    [1] : 2 [Type: int] 
    [2] : 3 [Type: int] 
    [3] : 4 [Type: int] 
    [4] : 5 [Type: int] 

    check this stack overflow post

    Post edited by raj_r on
  • raj_rraj_r Member - All Emails Posts: 981
    edited July 8

    the other day i was mucking around with some vectors in windbg and i happened
    to unassemble the vector::size() function
    looking at the disassembly and the crt src for the same function
    i happened to realize that you can set a transparent expression in the watch window to look at the vector::size()

    here is the disassembly of size() function for a vector in question

    :000> x vect!std::vector<int,std::allocator<int> >::size
    00007ff7`57cfa6f0 vect!std::vector<int,std::allocator<int> >::size (void)
    0:000> uf 7ff757cfa6f0
    vect!std::vector<int,std::allocator<int> >::size 
     [c:\program files (x86)\microsoft visual studio\2017\community\vc\tools\msvc\14.16.27023\include\vector @ 1703]:
     1703 00007ff7`57cfa6f0 48894c2408      mov     qword ptr [rsp+8],rcx
     1703 00007ff7`57cfa6f5 4883ec38        sub     rsp,38h
     1704 00007ff7`57cfa6f9 488b4c2440      mov     rcx,qword ptr [rsp+40h]
     1704 00007ff7`57cfa6fe e8bca9feff      call    vect!ILT+16570
     1704 00007ff7`57cfa703 4889442420      mov     qword ptr [rsp+20h],rax
     1704 00007ff7`57cfa708 488b4c2440      mov     rcx,qword ptr [rsp+40h]
     1704 00007ff7`57cfa70d e85a93feff      call    vect!ILT+10855
     1704 00007ff7`57cfa712 488b00          mov     rax,qword ptr [rax]
     1704 00007ff7`57cfa715 488b4c2420      mov     rcx,qword ptr [rsp+20h]
     1704 00007ff7`57cfa71a 488b09          mov     rcx,qword ptr [rcx]
     1704 00007ff7`57cfa71d 482bc8          sub     rcx,rax
     1704 00007ff7`57cfa720 488bc1          mov     rax,rcx
     1704 00007ff7`57cfa723 48c1f802        sar     rax,2
     1705 00007ff7`57cfa727 4883c438        add     rsp,38h
     1705 00007ff7`57cfa72b c3              ret
    windbg> .open -a 7ff757cfa6f0

    and the relevent src code from crt sources

                _NODISCARD size_type size() const noexcept
                    {   // return length of sequence
                    return (static_cast<size_type>(this->_Mylast() - this->_Myfirst()));

    so basically if you set a watch expression like

    systemHandles._Mypair._Myval2._Mylast - systemHandles._Mypair._Myval2._Myfirst

    windbg will resolve the size() in the watch window (it will do the pointer arithmetic and display the actual size if you are wondering

    how address x - address y each being 8 bytes wide result in 5

    0:000> ?? g1._Mypair._Myval2._Mylast
    int * 0x0000026f`5e0197a4
    0:000> ?? g1._Mypair._Myval2._Mylast - g1._Mypair._Myval2._Myfirst
    int64 0n5
    0:000> ?? 0x0000026f`5e0197a4 - 0x0000026f`5e019790
    int64 0n20
    0:000> ?? ( 0x0000026f`5e0197a4 - 0x0000026f`5e019790 ) / sizeof(int)
    unsigned int64 5

    Post edited by raj_r on
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE