Re: How to easily determine module&offset into for a given address?

WINDBG
1

Looks like you’re running the beta… I’m running the latest stable
build. It could be something added recently.

Croci, MaryBeth wrote:

This also works for me:

3: kd> lm a b9cefe2a
start end module name
b9cec000 b9d009e0 naiavf5x (no symbols)

I’m running Windbg version 6.3.0005.1. What version do you have?

-----Original Message-----
From: Nick Ryan [mailto:xxxxx@nryan.com]
Sent: Friday, December 12, 2003 1:55 PM
To: Kernel Debugging Interest List
Subject: [windbg] Re: How to easily determine module&offset into for a
given address?

Often I’ll be looking at a stack trace with multiple unknown return
addresses in it, and I want to quickly be able to tell which module a
given return address resides in. (And I either don’t have symbols for
many of these drivers or are too lazy to .reload them myself).

lm -a is not working for me. I did a !drivers and notice that the base
address of NAVAP.SYS (an A/V driver) is 0xf4dd9000. So then I do:

lm a 0xf4dd9010

and get:

kd> lm a 0xf4dd9010
start end module name

Unloaded modules:

Nathan Nesbit wrote:

>ln

will give you the closest matching symbols (which contains
>>the module name)
>>
>>lm -a will give the module the address is in.
>>
>>Perhaps you could tell us what you are trying to accomplish high level
>>and we could give some better ideas. I, for one, am interested in what
>>knowing why you want the offset within a module.
>>
>>
>>-----Original Message-----
>>From: xxxxx@lists.osr.com
>>[mailto:xxxxx@lists.osr.com] On Behalf Of Scott Noone
>>Sent: Thursday, December 11, 2003 2:41 PM
>>To: Kernel Debugging Interest List
>>Subject: [windbg] Re: How to easily determine module&offset into for a
>>given address?
>>
>>
>> I don't know any offhand. You could either write your own extension
>>or
>>try to cook something convoluted up with !for_each_module. I just took a
>>stab at it and this doesn't do exactly what you want but it might get
>>you in
>>the right direction:
>>
>>!for_each_module j address > @#Base & address < @#End '.echo Address is
>>in
>>module @#ModuleName - Module base @#Base
>>
>> There might be / probably is a better way, but it's something...
>>
>>-scott
>>
>>--
>>Scott Noone
>>Software Engineer
>>OSR Open Systems Resources, Inc.
>>http://www.osronline.com
>>
>>"Nick Ryan" wrote in message news:xxxxx@windbg...
>>
>>
>>>Is there a !windbg command that can take an address and return the
>>>module name and offset where that address resides (if any)? I'm tired
>>
>>of
>>
>>
>>>having to manually scan through the list of base addresses return by
>>>!drivers to eyeball which one is closest too and less than the address
>>>I'm curious about. (No, the ln command does not work for this
>>
>>purpose).
>>
>>
>>>--
>>>Nick Ryan (MVP for DDK)
>>>
>>>
>>>
>>
>>
>>
>>
>>---
>>You are currently subscribed to windbg as: xxxxx@microsoft.com
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>

--
Nick Ryan (MVP for DDK)
2

I tried this on both 6.2.13 and 6.3.5 but could not repro the scenario.
If you can repro this in a minidump, can you attach it to an email and
send to xxxxx@microsoft.com?