how to find the this pointer

WINDBG
1

I want to write conditional break points for c++ objects inside a member
function. I need to find the this pointer passed to the function so that I
can do a conditional based on another member variable.

e.g.

class foo
{
private:
int i;
public:
void doblah();
}

i want to set a break point inside doblah() if i=10; for that I need the
this pointer passed in.

This is to be done in the kernel debugger, not user mode.

thanks

al

2

this pointer is normally available in Register ecx (there are
discussions which discuss why sometimes this pointer will not be in
ecx in this list for you to be aware of )

if ecx holds the this pointer you can use c++ expression evaluator on it

assuming you have some code like this

#include
using namespace std;
class Square {
private:
int length;
int breadth;
public:
Square(int l=2.0, int b=2.0) {
length = l;
breadth = b;
}
int Area() {
return length * breadth;
}
};
int main(void)
{
int len = 3;
for(int i=1;i<10;i++){
Square sq1(len, i);
cout << sq1.Area() < }
return 0;
}

you can employ a conditional like this

0:000> bp cpclass!Square::Area “.if( @@c++(((Square *) @ecx)->breadth
) != 8 ) {.echo breadth != 8 ;gc }”
0:000> bl
0 e 000833f0 0001 (0001) 0: **** cpclass!Square::Area “.if(
@@c++(((Square *) @ecx)->breadth ) != 8 ) {.echo breadth != 8 ;gc }”
0:000> g
ModLoad: 74030000 74033000
C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL
ModLoad: 69330000 69333000 E:\ewdk\Program Files\Windows
Kits\10\Tools\bin\i386\api-ms-win-core-localization-obsolete-l1-2-0.DLL
breadth != 8
breadth != 8
breadth != 8
breadth != 8
breadth != 8
breadth != 8
breadth != 8
eax=002cf8e8 ebx=7ffdd000 ecx=002cf8e8 edx=002cf8e8 esi=00101dbc edi=00101dc0
eip=000833f0 esp=002cf8e0 ebp=002cf8f8 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000293
cpclass!Square::Area:
000833f0 55 push ebp

0:000> ?? ((square *) @ecx)->breadth
int 0n8

On 5/14/16, A P wrote:
> I want to write conditional break points for c++ objects inside a member
> function. I need to find the this pointer passed to the function so that I
> can do a conditional based on another member variable.
>
> e.g.
>
> class foo
> {
> private:
> int i;
> public:
> void doblah();
> }
>
>
> i want to set a break point inside doblah() if i=10; for that I need the
> this pointer passed in.
>
> This is to be done in the kernel debugger, not user mode.
>
> thanks
>
> al
>
> —
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
> drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:</http:></http:>

3

thank you for the detailed example!

On Sat, May 14, 2016 at 6:43 AM, raj r wrote:

> this pointer is normally available in Register ecx (there are
> discussions which discuss why sometimes this pointer will not be in
> ecx in this list for you to be aware of )
>
> if ecx holds the this pointer you can use c++ expression evaluator on it
>
> assuming you have some code like this
>
> #include
> using namespace std;
> class Square {
> private:
> int length;
> int breadth;
> public:
> Square(int l=2.0, int b=2.0) {
> length = l;
> breadth = b;
> }
> int Area() {
> return length * breadth;
> }
> };
> int main(void)
> {
> int len = 3;
> for(int i=1;i<10;i++){
> Square sq1(len, i);
> cout << sq1.Area() <> }
> return 0;
> }
>
> you can employ a conditional like this
>
> 0:000> bp cpclass!Square::Area “.if( @@c++(((Square *) @ecx)->breadth
> ) != 8 ) {.echo breadth != 8 ;gc }”
> 0:000> bl
> 0 e 000833f0 0001 (0001) 0: **** cpclass!Square::Area “.if(
> @@c++(((Square *) @ecx)->breadth ) != 8 ) {.echo breadth != 8 ;gc }”
> 0:000> g
> ModLoad: 74030000 74033000
> C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL
> ModLoad: 69330000 69333000 E:\ewdk\Program Files\Windows
> Kits\10\Tools\bin\i386\api-ms-win-core-localization-obsolete-l1-2-0.DLL
> breadth != 8
> breadth != 8
> breadth != 8
> breadth != 8
> breadth != 8
> breadth != 8
> breadth != 8
> eax=002cf8e8 ebx=7ffdd000 ecx=002cf8e8 edx=002cf8e8 esi=00101dbc
> edi=00101dc0
> eip=000833f0 esp=002cf8e0 ebp=002cf8f8 iopl=0 nv up ei ng nz ac po
> cy
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
> efl=00000293
> cpclass!Square::Area:
> 000833f0 55 push ebp
>
> 0:000> ?? ((square *) @ecx)->breadth
> int 0n8
>
>
> On 5/14/16, A P wrote:
> > I want to write conditional break points for c++ objects inside a member
> > function. I need to find the this pointer passed to the function so that
> I
> > can do a conditional based on another member variable.
> >
> > e.g.
> >
> > class foo
> > {
> > private:
> > int i;
> > public:
> > void doblah();
> > }
> >
> >
> > i want to set a break point inside doblah() if i=10; for that I need the
> > this pointer passed in.
> >
> > This is to be done in the kernel debugger, not user mode.
> >
> > thanks
> >
> > al
> >
> > —
> > WINDBG is sponsored by OSR
> >
> > OSR is hiring!! Info at http://www.osr.com/careers
> >
> >
> > MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software
> > drivers!
> > Details at http:
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http:
>
> —
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:></http:></http:>