!list not 64-bit aware...

WINDBG
1

I know there are a substantial number of ways to walk doubly linked
lists; my favorite has always been !list because of the way it will
validate the list and show a damaged entry. However, I just tried it on
my amd64 system and it doesn’t work right:

Just FYI:

1: kd> !list fffffadf`c40e1158

struct _LIST_ENTRY (sizeof=8)

+0 struct _LIST_ENTRY *Flink = 0xc40e1158: Could not read data for
structure member(Flink).

1: kd> dl fffffadf`c40e1158

fffffadfc40e1158 fffffa800ad17bd0 fffffa80`02d37410

fffffadfc40e1168 74756f5220424346 65637845`20656e69

It sure looks like that’s a 32-bit truncation of the pointer. The
command should either be removed (at least on 64-bit systems) or fixed
to work properly (it appears to come from winext\ext.dll so it is also
possible this isn’t the old list command from kdex2x86 but some other
variant.)

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

2

Are you sure it’s coming from ext.dll? The ext.dll implementation
doesn’t produce output like that as far as I know. It’s also fully
64-bit compatible.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Tuesday, December 20, 2005 9:15 AM
To: Kernel Debugging Interest List
Subject: [windbg] !list not 64-bit aware…

I know there are a substantial number of ways to walk doubly linked
lists; my favorite has always been !list because of the way it will
validate the list and show a damaged entry. However, I just tried it on
my amd64 system and it doesn’t work right:

Just FYI:

1: kd> !list fffffadf`c40e1158

struct _LIST_ENTRY (sizeof=8)

+0 struct _LIST_ENTRY *Flink = 0xc40e1158: Could not read data for
structure member(Flink).

1: kd> dl fffffadf`c40e1158

fffffadfc40e1158 fffffa800ad17bd0 fffffa80`02d37410

fffffadfc40e1168 74756f5220424346 65637845`20656e69

It sure looks like that’s a 32-bit truncation of the pointer. The
command should either be removed (at least on 64-bit systems) or fixed
to work properly (it appears to come from winext\ext.dll so it is also
possible this isn’t the old list command from kdex2x86 but some other
variant.)

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

You are currently subscribed to windbg as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Interesting. I walked through the extensions from .chain and it was the
first one with a !list export so I assumed that was what this invoked.
But you are right, if I invoke it directly I get different output. I’ll
have to figure out from whence this is being invoked.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Drew Bliss
Sent: Tuesday, December 20, 2005 2:05 PM
To: Kernel Debugging Interest List
Subject: RE: [windbg] !list not 64-bit aware…

Are you sure it’s coming from ext.dll? The ext.dll implementation
doesn’t produce output like that as far as I know. It’s also fully
64-bit compatible.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Tuesday, December 20, 2005 9:15 AM
To: Kernel Debugging Interest List
Subject: [windbg] !list not 64-bit aware…

I know there are a substantial number of ways to walk doubly linked
lists; my favorite has always been !list because of the way it will
validate the list and show a damaged entry. However, I just tried it on
my amd64 system and it doesn’t work right:

Just FYI:

1: kd> !list fffffadf`c40e1158

struct _LIST_ENTRY (sizeof=8)

+0 struct _LIST_ENTRY *Flink = 0xc40e1158: Could not read data for
structure member(Flink).

1: kd> dl fffffadf`c40e1158

fffffadfc40e1158 fffffa800ad17bd0 fffffa80`02d37410

fffffadfc40e1168 74756f5220424346 65637845`20656e69

It sure looks like that’s a 32-bit truncation of the pointer. The
command should either be removed (at least on 64-bit systems) or fixed
to work properly (it appears to come from winext\ext.dll so it is also
possible this isn’t the old list command from kdex2x86 but some other
variant.)

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

You are currently subscribed to windbg as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to windbg as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com