Is there a !windbg command that can take an address and return the
module name and offset where that address resides (if any)? I’m tired of
having to manually scan through the list of base addresses return by
!drivers to eyeball which one is closest too and less than the address
I’m curious about. (No, the ln command does not work for this purpose).
–
Nick Ryan (MVP for DDK)
I don’t know any offhand. You could either write your own extension or
try to cook something convoluted up with !for_each_module. I just took a
stab at it and this doesn’t do exactly what you want but it might get you in
the right direction:
!for_each_module j address > @#Base & address < @#End '.echo Address is in
module @#ModuleName - Module base @#Base
There might be / probably is a better way, but it’s something…
-scott
–
Scott Noone
Software Engineer
OSR Open Systems Resources, Inc.
http://www.osronline.com
“Nick Ryan” wrote in message news:xxxxx@windbg…
>
> Is there a !windbg command that can take an address and return the
> module name and offset where that address resides (if any)? I’m tired of
> having to manually scan through the list of base addresses return by
> !drivers to eyeball which one is closest too and less than the address
> I’m curious about. (No, the ln command does not work for this purpose).
>
> –
> Nick Ryan (MVP for DDK)
>
>
>
ln
will give you the closest matching symbols (which containsOften I’ll be looking at a stack trace with multiple unknown return
addresses in it, and I want to quickly be able to tell which module a
given return address resides in. (And I either don’t have symbols for
many of these drivers or are too lazy to .reload them myself).
lm -a is not working for me. I did a !drivers and notice that the base
address of NAVAP.SYS (an A/V driver) is 0xf4dd9000. So then I do:
lm a 0xf4dd9010
and get:
kd> lm a 0xf4dd9010
start end module name
Unloaded modules:
Nathan Nesbit wrote:
will give you the closest matching symbols (which containsln