I want to use DbgPrint() to print out the symbol of an address in kernel
level. For example:
DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
Is there such a DDI?
thx,
((&->
Use &symbol to get the address of a symbol in your code.
If you want the address of an arbitrary symbol in some other component, use the x command in the debugger.
-p
On Sep 19, 2011, at 7:50 AM, “QuasiCodo” wrote:
> I want to use DbgPrint() to print out the symbol of an address in kernel level. For example:
>
> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
>
> Is there such a DDI?
>
> thx,
>
> ((&->
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
For “ResolveSymbol?”
No.
Mm
On Sep 19, 2011 10:47 AM, “QuasiCodo” wrote:
> I want to use DbgPrint() to print out the symbol of an address in kernel
> level. For example:
>
> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
>
> Is there such a DDI?
>
> thx,
>
> ((&->
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
While it’s a cheap substitute, you can DML-ize your DbgPrint so that you
just have to click it to get the function name. For example, something like
this:
DbgPrint(“<?dml ?>Function 0x%p\n”, funcPtr,
funcPtr);
Will turn into a link in your debug output that, when clicked, will execute
“ln address”.
-scott
–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com
“Martin O’Brien” wrote in message
news:xxxxx@ntdev…
For “ResolveSymbol?”
No.
Mm
On Sep 19, 2011 10:47 AM, “QuasiCodo” wrote:
> I want to use DbgPrint() to print out the symbol of an address in kernel
> level. For example:
>
> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
>
> Is there such a DDI?
>
> thx,
>
> ((&->
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
On 19-Sep-2011 18:08, Peter Wieland wrote:
Use&symbol to get the address of a symbol in your code.
If you want the address of an arbitrary symbol in some other component, use the x command in the debugger.
-p
Is there a way to automatically expand DML commands printed by target, like:
DbgPrint (“<?dml ?> Resolve %p”,
funcptr, funcptr);
Regards,
–pa
On Sep 19, 2011, at 7:50 AM, “QuasiCodo” wrote:
>
>> I want to use DbgPrint() to print out the symbol of an address in kernel level. For example:
>>
>> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
>>
>> Is there such a DDI?
>>
>> thx,
You could use .ocommand to feed commands directly in to the debugger from debug prints (if you trust the target). That facility could be used to perform this task if you really wanted to.
- S
From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of Pavel A [xxxxx@fastmail.fm]
Sent: Monday, September 19, 2011 5:34 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] DbgPrint and Symbols
On 19-Sep-2011 18:08, Peter Wieland wrote:
Use&symbol to get the address of a symbol in your code.
If you want the address of an arbitrary symbol in some other component, use the x command in the debugger.
-p
Is there a way to automatically expand DML commands printed by target, like:
DbgPrint (“<?dml ?> Resolve %p”,
funcptr, funcptr);
Regards,
–pa
On Sep 19, 2011, at 7:50 AM, “QuasiCodo” wrote:
>
>> I want to use DbgPrint() to print out the symbol of an address in kernel level. For example:
>>
>> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
>>
>> Is there such a DDI?
>>
>> thx,
—
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
you can do some thing like this and in debugger you can get very good
output all undocumented anywhere like below
int _tmain(int argc, _TCHAR* argv)
{
char buff[0x200];
printf (“Hello I am Going To Call A Dml Enabled Output Debug String Now \n”);
sprintf_s(buff,sizeof(buff),“Function Ptr is <?dml ?>%x\n">Clickme\n” ,&printf);
OutputDebugStringA(buff);
return 0;
}
0:000> g
ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll
Function Ptr is Clickme
eax=00000000 ebx=00000000 ecx=7c800000 edx=64d2c1e8 esi=7c90de6e edi=00000000
eip=7c90e514 esp=0013fdf0 ebp=0013feec iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c90e514 c3 ret
0:000> ln 1025abb0
Browse module
Set bu breakpoint
*** ERROR: Symbol file could not be found. Defaulted to export
symbols for C:\WINDOWS\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\MSVCR90D.dll
(1025abb0) MSVCR90D!printf | (1025acf0) MSVCR90D!printf_l
Exact matches:
MSVCR90D!printf ()
0:000> lmDva 0x1025abb0
Browse full module list
start end module name
10200000 10323000 MSVCR90D (export symbols)
C:\WINDOWS\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\MSVCR90D.dll
Loaded symbol image file:
C:\WINDOWS\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\MSVCR90D.dll
Image path:
C:\WINDOWS\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\MSVCR90D.dll
Image name: MSVCR90D.dll
Browse all global symbols functions data
Timestamp: Tue Jul 29 16:23:59 2008 (488EF6C7)
CheckSum: 00123D7E
ImageSize: 00123000
File version: 9.0.30729.1
Product version: 9.0.30729.1
File flags: 1 (Mask 3F) Debug
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft? Visual Studio? 2008
InternalName: MSVCR90D.DLL
OriginalFilename: MSVCR90D.DLL
ProductVersion: 9.00.30729.1
FileVersion: 9.00.30729.1
FileDescription: Microsoft? C Runtime Library
LegalCopyright: ? Microsoft Corporation. All rights reserved.
0:000> x /D MSVCR90D!a*
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
1023ba50 MSVCR90D!amsg_exit ()
10240d50 MSVCR90D!atol ()
10240d70 MSVCR90D!atol_l ()
10240d90 MSVCR90D!atoi ()
10240db0 MSVCR90D!atoi_l ()
10240dd0 MSVCR90D!atoi64 ()
10240df0 MSVCR90D!atoi64_l ()
10245be0 MSVCR90D!access ()
10245c10 MSVCR90D!access_s ()
10268650 MSVCR90D!asctime_s ()
10268db0 MSVCR90D!asctime ()
102716c0 MSVCR90D!atodbl_l ()
102717d0 MSVCR90D!atodbl ()
102717f0 MSVCR90D!atoldbl_l ()
10271900 MSVCR90D!atoldbl ()
10271920 MSVCR90D!atoflt_l ()
10271a30 MSVCR90D!atoflt ()
10271a50 MSVCR90D!atof_l ()
10271b90 MSVCR90D!atof ()
102cf840 MSVCR90D!atexit ()
102d27d0 MSVCR90D!aligned_malloc ()
102d2800 MSVCR90D!aligned_malloc_dbg ()
102d2830 MSVCR90D!aligned_realloc ()
102d2860 MSVCR90D!aligned_recalloc ()
102d2890 MSVCR90D!aligned_realloc_dbg ()
102d28c0 MSVCR90D!aligned_recalloc_dbg ()
102d28f0 MSVCR90D!aligned_offset_malloc ()
102d2920 MSVCR90D!aligned_offset_malloc_dbg ()
102d2ad0 MSVCR90D!aligned_offset_realloc ()
102d2b00 MSVCR90D!aligned_offset_recalloc ()
102d2b30 MSVCR90D!aligned_offset_realloc_dbg ()
102d2e00 MSVCR90D!aligned_offset_recalloc_dbg ()
102d2f10 MSVCR90D!aligned_free ()
102d2f30 MSVCR90D!aligned_free_dbg ()
102d3050 MSVCR90D!aligned_msize ()
102d3070 MSVCR90D!aligned_msize_dbg ()
102db51d MSVCR90D!abnormal_termination ()
102dbb90 MSVCR90D!abs64 ()
102dbbe0 MSVCR90D!assert ()
102de980 MSVCR90D!abort ()
102e2310 MSVCR90D!abs ()
102ec870 MSVCR90D!acos ()
102ec9c0 MSVCR90D!asin ()
102ecb10 MSVCR90D!atan ()
102ecc30 MSVCR90D!atan2 ()
102f1857 MSVCR90D!adj_fdiv_r ()
102f1d1c MSVCR90D!adj_fdiv_m32 ()
102f1d68 MSVCR90D!adj_fdiv_m64 ()
102f1db4 MSVCR90D!adj_fdiv_m16i ()
102f1de8 MSVCR90D!adj_fdiv_m32i ()
102f1e1c MSVCR90D!adj_fdivr_m32 ()
102f1e68 MSVCR90D!adj_fdivr_m64 ()
102f1eb4 MSVCR90D!adj_fdivr_m16i ()
102f1ee8 MSVCR90D!adj_fdivr_m32i ()
102f214c MSVCR90D!adj_fprem ()
102f2404 MSVCR90D!adj_fprem1 ()
102f24c5 MSVCR90D!adj_fpatan ()
102f24c8 MSVCR90D!adj_fptan ()
10311040 MSVCR90D!aexit_rtn ()
10315aa4 MSVCR90D!acmdln ()
103166cc MSVCR90D!adjust_fdiv ()
0:000> x /D /f MSVCR90D!a*
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
1023ba50 MSVCR90D!amsg_exit ()
10240d50 MSVCR90D!atol ()
10240d70 MSVCR90D!atol_l ()
10240d90 MSVCR90D!atoi ()
10240db0 MSVCR90D!atoi_l ()
10240dd0 MSVCR90D!atoi64 ()
10240df0 MSVCR90D!atoi64_l ()
10245be0 MSVCR90D!access ()
10245c10 MSVCR90D!access_s ()
10268650 MSVCR90D!asctime_s ()
10268db0 MSVCR90D!asctime ()
102716c0 MSVCR90D!atodbl_l ()
102717d0 MSVCR90D!atodbl ()
102717f0 MSVCR90D!atoldbl_l ()
10271900 MSVCR90D!atoldbl ()
10271920 MSVCR90D!atoflt_l ()
10271a30 MSVCR90D!atoflt ()
10271a50 MSVCR90D!atof_l ()
10271b90 MSVCR90D!atof ()
102cf840 MSVCR90D!atexit ()
102d27d0 MSVCR90D!aligned_malloc ()
102d2800 MSVCR90D!aligned_malloc_dbg ()
102d2830 MSVCR90D!aligned_realloc ()
102d2860 MSVCR90D!aligned_recalloc ()
102d2890 MSVCR90D!aligned_realloc_dbg ()
102d28c0 MSVCR90D!aligned_recalloc_dbg ()
102d28f0 MSVCR90D!aligned_offset_malloc ()
102d2920 MSVCR90D!aligned_offset_malloc_dbg ()
102d2ad0 MSVCR90D!aligned_offset_realloc ()
102d2b00 MSVCR90D!aligned_offset_recalloc ()
102d2b30 MSVCR90D!aligned_offset_realloc_dbg ()
102d2e00 MSVCR90D!aligned_offset_recalloc_dbg ()
102d2f10 MSVCR90D!aligned_free ()
102d2f30 MSVCR90D!aligned_free_dbg ()
102d3050 MSVCR90D!aligned_msize ()
102d3070 MSVCR90D!aligned_msize_dbg ()
102db51d MSVCR90D!abnormal_termination ()
102dbb90 MSVCR90D!abs64 ()
102dbbe0 MSVCR90D!assert ()
102de980 MSVCR90D!abort ()
102e2310 MSVCR90D!abs ()
102ec870 MSVCR90D!acos ()
102ec9c0 MSVCR90D!asin ()
102ecb10 MSVCR90D!atan ()
102ecc30 MSVCR90D!atan2 ()
102f1857 MSVCR90D!adj_fdiv_r ()
102f1d1c MSVCR90D!adj_fdiv_m32 ()
102f1d68 MSVCR90D!adj_fdiv_m64 ()
102f1db4 MSVCR90D!adj_fdiv_m16i ()
102f1de8 MSVCR90D!adj_fdiv_m32i ()
102f1e1c MSVCR90D!adj_fdivr_m32 ()
102f1e68 MSVCR90D!adj_fdivr_m64 ()
102f1eb4 MSVCR90D!adj_fdivr_m16i ()
102f1ee8 MSVCR90D!adj_fdivr_m32i ()
102f214c MSVCR90D!adj_fprem ()
102f2404 MSVCR90D!adj_fprem1 ()
102f24c5 MSVCR90D!adj_fpatan ()
102f24c8 MSVCR90D!adj_fptan ()
10311040 MSVCR90D!aexit_rtn ()
10315aa4 MSVCR90D!acmdln ()
103166cc MSVCR90D!adjust_fdiv ()
0:000> x /D /d MSVCR90D!a*
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
all clickety click
rgrds
raj
On 9/19/11, QuasiCodo wrote:
> I want to use DbgPrint() to print out the symbol of an address in kernel
> level. For example:
>
> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
>
> Is there such a DDI?
>
> thx,
>
> ((&->
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
thanks and regards
raj_r
tx SkyWing ,
int _tmain(int argc, _TCHAR* argv)
{
char buff[0x200];
printf (“Hello I am Going To Call A Dml Enabled Output Debug String Now \n”);
sprintf_s(buff,sizeof(buff),“Function Ptr is <?dml ?>%x\n">Clickme\n” ,&printf);
OutputDebugStringA(buff);
OutputDebugStringA(“magiccommand ln &printf;kb”);
return 0;
}
neat ouptut
but it seems it broke the output of earlier OutputDebugString dont
see the click me string 
on windbg command window and this takes too
long also
dont know why
anyway
nice Toy To play with
0:000> .ocommand
Treat output prefixed with ‘magiccommand’ as a command
0:000> g
ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll
*** WARNING: Unable to verify checksum for funcdbgstr.exe
Browse module
Set bu breakpoint
(0041147e) funcdbgstr!printf | (00411484) funcdbgstr!sprintf_s
Exact matches:
ChildEBP RetAddr Args to Child
00 0013fa1c 7c85ada0 40010006 00000000 00000002 kernel32!RaiseException+0x53
01 0013fc84 0041361b 004162e8 015af554 010d4886 kernel32!OutputDebugStringA+0x54
02 0013ff68 004119f8 00000001 00392950 00395e70 funcdbgstr!wmain+0x8b
03 0013ffb8 0041183f 0013fff0 7c817077 015af554
funcdbgstr!__tmainCRTStartup+0x1a8
04 0013ffc0 7c817077 015af554 010d4886 7ffde000 funcdbgstr!wmainCRTStartup+0xf
05 0013fff0 00000000 00411078 00000000 78746341 kernel32!BaseProcessStart+0x23
eax=0013f9cc ebx=7ffde000 ecx=00000000 edx=00000000 esi=0013fa48 edi=0013ff68
eip=7c812afb esp=0013f9c8 ebp=0013fa1c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
kernel32!RaiseException+0x53:
7c812afb 5e pop esi
On 9/20/11, Skywing wrote:
> You could use .ocommand to feed commands directly in to the debugger from
> debug prints (if you trust the target). That facility could be used to
> perform this task if you really wanted to.
>
> - S
> ________________________________________
> From: xxxxx@lists.osr.com [xxxxx@lists.osr.com]
> on behalf of Pavel A [xxxxx@fastmail.fm]
> Sent: Monday, September 19, 2011 5:34 PM
> To: Windows System Software Devs Interest List
> Subject: Re:[ntdev] DbgPrint and Symbols
>
> On 19-Sep-2011 18:08, Peter Wieland wrote:
>> Use&symbol to get the address of a symbol in your code.
>>
>> If you want the address of an arbitrary symbol in some other component,
>> use the x command in the debugger.
>>
>> -p
>
> Is there a way to automatically expand DML commands printed by target, like:
> DbgPrint (“<?dml ?> Resolve %p”,
> funcptr, funcptr);
>
> Regards,
> --pa
>
>
>> On Sep 19, 2011, at 7:50 AM, “QuasiCodo” wrote:
>>
>>> I want to use DbgPrint() to print out the symbol of an address in kernel
>>> level. For example:
>>>
>>> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr));
>>>
>>> Is there such a DDI?
>>>
>>> thx,
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
thanks and regards
raj_r
I noticed the “sizeof(buff)” in the sprintf_s function.
You might wish to change this to “sizeof(buf)/sizeof(TCHAR)”.
----- Original Message -----
From: raj_r
Sent: 09/20/11 01:30 AM
To: Windows System Software Devs Interest List
Subject: Re: Re:[ntdev] DbgPrint and Symbols
tx SkyWing , int _tmain(int argc, _TCHAR* argv) { char buff[0x200]; printf (“Hello I am Going To Call A Dml Enabled Output Debug String Now \n”); sprintf_s(buff,sizeof(buff),“Function Ptr is <?dml ?>Clickme\n” ,&printf); OutputDebugStringA(buff); OutputDebugStringA(“magiccommand ln &printf;kb”); return 0; } neat ouptut but it seems it broke the output of earlier OutputDebugString dont see the click me string on windbg command window and this takes too long also dont know why anyway nice Toy To play with 0:000> .ocommand Treat output prefixed with ‘magiccommand’ as a command 0:000> g ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll *** WARNING: Unable to verify checksum for funcdbgstr.exe Browse module Set bu breakpoint (0041147e) funcdbgstr!printf | (00411484) funcdbgstr!sprintf_s Exact matches: # ChildEBP RetAddr Args to Child 00 0013fa1c 7c85ada0 40010006 00000000 00000002 kernel32!RaiseException+0x53 01 0013fc84 0041361b 004162e8
015af554 010d4886 kernel32!OutputDebugStringA+0x54 02 0013ff68 004119f8 00000001 00392950 00395e70 funcdbgstr!wmain+0x8b 03 0013ffb8 0041183f 0013fff0 7c817077 015af554 funcdbgstr!__tmainCRTStartup+0x1a8 04 0013ffc0 7c817077 015af554 010d4886 7ffde000 funcdbgstr!wmainCRTStartup+0xf 05 0013fff0 00000000 00411078 00000000 78746341 kernel32!BaseProcessStart+0x23 eax=0013f9cc ebx=7ffde000 ecx=00000000 edx=00000000 esi=0013fa48 edi=0013ff68 eip=7c812afb esp=0013f9c8 ebp=0013fa1c iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 kernel32!RaiseException+0x53: 7c812afb 5e pop esi On 9/20/11, Skywing wrote: > You could use .ocommand to feed commands directly in to the debugger from > debug prints (if you trust the target). That facility could be used to > perform this task if you really wanted to. > > - S > ________________________________________ > From: xxxxx@lists.osr.com [xxxxx@lis
ts.osr.com] > on behalf of Pavel A [xxxxx@fastmail.fm] > Sent: Monday, September 19, 2011 5:34 PM > To: Windows System Software Devs Interest List > Subject: Re:[ntdev] DbgPrint and Symbols > > On 19-Sep-2011 18:08, Peter Wieland wrote: >> Use&symbol to get the address of a symbol in your code. >> >> If you want the address of an arbitrary symbol in some other component, >> use the x command in the debugger. >> >> -p > > Is there a way to automatically expand DML commands printed by target, like: > DbgPrint (“<?dml ?> Resolve %p”, > funcptr, funcptr); > > Regards, > --pa > > >> On Sep 19, 2011, at 7:50 AM, “QuasiCodo” wrote: >> >>> I want to use DbgPrint() to print out the symbol of an address in kernel >>> level. For example: >>> >>> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr)); >>> >>> Is there such a DDI? >>> >>> thx, > > — > NTDEV is sponsored by OSR > > For our schedule of WDF, WDM, debuggi
ng and other seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer > — > NTDEV is sponsored by OSR > > For our schedule of WDF, WDM, debugging and other seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer > – thanks and regards raj_r — NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Opps, never mind. Brain cloud.
----- Original Message -----
From: John Bachus
Sent: 09/21/11 09:04 AM
To: Windows System Software Devs Interest List
Subject: Re: Re:[ntdev] DbgPrint and Symbols
I noticed the “sizeof(buff)” in the sprintf_s function.
You might wish to change this to “sizeof(buf)/sizeof(TCHAR)”.
----- Original Message -----
From: raj_r
Sent: 09/20/11 01:30 AM
To: Windows System Software Devs Interest List
Subject: Re: Re:[ntdev] DbgPrint and Symbols
tx SkyWing , int _tmain(int argc, _TCHAR* argv) { char buff[0x200]; printf (“Hello I am Going To Call A Dml Enabled Output Debug String Now \n”); sprintf_s(buff,sizeof(buff),“Function Ptr is <?dml ?>Clickme\n” ,&printf); OutputDebugStringA(buff); OutputDebugStringA(“magiccommand ln &printf;kb”); return 0; } neat ouptut but it seems it broke the output of earlier OutputDebugString dont see the click me string on windbg command window and this takes too long also dont know why anyway nice Toy To play with 0:000> .ocommand Treat output prefixed with ‘magiccommand’ as a command 0:000> g ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll *** WARNING: Unable to verify checksum for funcdbgstr.exe Browse module Set bu breakpoint (0041147e) funcdbgstr!printf | (00411484) funcdbgstr!sprintf_s Exact matches: # ChildEBP RetAddr Args to Child 00 0013fa1c 7c85ada0 40010006 00000000 00000002 kernel32!RaiseException+0x53 01 0013fc84 0041361b 004162e8
015af554 010d4886 kernel32!OutputDebugStringA+0x54 02 0013ff68 004119f8 00000001 00392950 00395e70 funcdbgstr!wmain+0x8b 03 0013ffb8 0041183f 0013fff0 7c817077 015af554 funcdbgstr!__tmainCRTStartup+0x1a8 04 0013ffc0 7c817077 015af554 010d4886 7ffde000 funcdbgstr!wmainCRTStartup+0xf 05 0013fff0 00000000 00411078 00000000 78746341 kernel32!BaseProcessStart+0x23 eax=0013f9cc ebx=7ffde000 ecx=00000000 edx=00000000 esi=0013fa48 edi=0013ff68 eip=7c812afb esp=0013f9c8 ebp=0013fa1c iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 kernel32!RaiseException+0x53: 7c812afb 5e pop esi On 9/20/11, Skywing < xxxxx@valhallalegends.com > wrote: > You could use .ocommand to feed commands directly in to the debugger from > debug prints (if you trust the target). That facility could be used to > perform this task if you really wanted to. > > - S > ________________________________________ > From: xxxxx@lists.osr.com [ bounce-475319-3974
xxxxx@lists.osr.com ] > on behalf of Pavel A [xxxxx@fastmail.fm] > Sent: Monday, September 19, 2011 5:34 PM > To: Windows System Software Devs Interest List > Subject: Re:[ntdev] DbgPrint and Symbols > > On 19-Sep-2011 18:08, Peter Wieland wrote: >> Use&symbol to get the address of a symbol in your code. >> >> If you want the address of an arbitrary symbol in some other component, >> use the x command in the debugger. >> >> -p > > Is there a way to automatically expand DML commands printed by target, like: > DbgPrint (“<?dml ?> Resolve %p”, > funcptr, funcptr); > > Regards, > --pa > > >> On Sep 19, 2011, at 7:50 AM, “QuasiCodo”< xxxxx@Yahoo.com > wrote: >> >>> I want to use DbgPrint() to print out the symbol of an address in kernel >>> level. For example: >>> >>> DbgPrint (“Function @%p = %s”, funcptr, ResolveSymbol(funcptr)); >>> >>> Is there such a DDI? >>> >>> thx, > > — > NTDEV is sponsored by OSR > > For our schedule of WDF, WD
M, debugging and other seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer > — > NTDEV is sponsored by OSR > > For our schedule of WDF, WDM, debugging and other seminars visit: > http://www.osr.com/seminars > > To unsubscribe, visit the List Server section of OSR Online at > http://www.osronline.com/page.cfm?name=ListServer > – thanks and regards raj_r — NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
John Bachus wrote:
I noticed the “sizeof(buff)” in the sprintf_s function.
You might wish to change this to “sizeof(buf)/sizeof(TCHAR)”.
You already posted a retraction, so I’ll eliminate the snarky comment.
There is an even better way to write that code, which avoids the
confusion altogether:
#include <atlstr.h>
…
{
CString buff;
buff.Format( _T(“Function Ptr is <?dml ?>%x\n">Clickme\n”), &printf );
OutputDebugString( buff );
}
–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.</atlstr.h>