Quick way to parse records

Albert

If a struct is defined like so:

typedef _S
{
Another_StructType Records[100];
} S;

is there a way in windbg to dump all the records in a loop just like we can if it was a LIST_ENTRY?

Tim_Roberts

That's very different from the LIST_ENTRY thing. There are no pointers to follow here. The "dt" command has a "-r" to go recursive and a "-a" that tells it how many array entries it should show.

Scott_Noone_(OSR)

Using the following:

typedef struct _RECORD
{
    ULONG Foo;
    ULONG Bar;
} RECORD;

typedef struct _STATE
{
    RECORD Records[100];
} STATE;

int main()
{
    STATE localXyz;

The old way to do this would be with a for loop:

.for (r @$t0 = 0; @$t0 < @@(#RTL_NUMBER_OF(localXyz.Records)); r @$t0 = @$t0 + 1) { ?? localXyz.Records[@$t0] }

That's ugly but you now have a way to execute a command for each entry.

The new way to do this would be with the Debugger Object Model (DOM) and dx command. You can get an attractive little table with this:

dx -r2 -g localXyz.Records

If you want to customize the output or do something else with each entry then you would use NatVIS:

https://www.osr.com/blog/2015/11/06/fun-windbg-natvis-support/

Enjoy!

Albert

Thanks a ton @Scott_Noone_(OSR) ! The first one was more than what I need, and the ability to execute additional commands is more helpful in my case.

@Scott_Noone_(OSR) said:
Using the following:

typedef struct _RECORD
{
    ULONG Foo;
    ULONG Bar;
} RECORD;

typedef struct _STATE
{
    RECORD Records[100];
} STATE;

int main()
{
    STATE localXyz;

The old way to do this would be with a for loop:

.for (r @$t0 = 0; @$t0 < @@(#RTL_NUMBER_OF(localXyz.Records)); r @$t0 = @$t0 + 1) { ?? localXyz.Records[@$t0] }

That's ugly but you now have a way to execute a command for each entry.

The new way to do this would be with the Debugger Object Model (DOM) and dx command. You can get an attractive little table with this:

dx -r2 -g localXyz.Records

If you want to customize the output or do something else with each entry then you would use NatVIS:

https://www.osr.com/blog/2015/11/06/fun-windbg-natvis-support/

Enjoy!