how to get both kernel's and user's call stack of the thread like Process Monitor / Process Explorer

NTDEV
1

how to get both kernel’s and user’s call stack of the thread like Process
Monitor / Process Explorer ? of course ,don’t use windbg.

it troubled me for a long me. i will be appreciated if anyone can give me
some advance.

I have a kernel roution, such as mycreatefile. I just want to write code to
dump the kernel’s and user’s call stack if mycreatefile is called, and then
continue to run(don’t crash the system, and don’t use windbg) .

1 Like
2

>how to get both kernel’s and user’s call stack of the thread like Process Monitor / Process Explorer ?

There was a StackWalk function.

Note that travelling through the FPO calls will require the .pdb symbols, which mean your code must download them from MS’s symbol server.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

3

thank you for your advice. but i found it just can get user mode stack
trace, but not kenerl mode stacke trace. is that right?

2009/12/28 Maxim S. Shatskih

> >how to get both kernel’s and user’s call stack of the thread like Process
> Monitor / Process Explorer ?
>
> There was a StackWalk function.
>
> Note that travelling through the FPO calls will require the .pdb symbols,
> which mean your code must download them from MS’s symbol server.
>
> –
> Maxim S. Shatskih
> Windows DDK MVP
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>