stack, trap frame, callstacks and so on..

NTDEV
1

Hi.

I’ve got very nooby question, but since there is a lot of professionals I belive you will be able to answer to my question.

I’m trying to understand windows nomenclature for stacks, callstacks and trap frames …

  1. My first request to you is to give me some tutorial, or simple answer what exactly trap frame is I belive it is not same as stack frame right?

  2. I would like to understand also what are ‘connections’ between stack, trap frame and call stack?

  3. In kernelapi there is something liek this: http://msdn.microsoft.com/en-us/library/windows/hardware/ff549299(v=vs.85).aspx but doc does not says anything about if it deals with kernel or user mode stack? (I read somewhere that there are kernel part of stack and user mode stack)

  4. How in WinDbg get user callstack. I;ve tried .process [PROCESS], .thread [THREAD] and then kv but I think it still is bad.

Thank you for patience and responses.

2

http://www.google.com/search?q=what+is+a+trap+frame

first hit dmitry

http://www.dumpanalysis.org/blog/index.php/2007/07/15/interrupts-and-exceptions-explained-part-4/

second hit raymond chen

http://blogs.msdn.com/b/oldnewthing/archive/2008/10/24/9013856.aspx
4th hit

from the horses mouth as they said in olden times

http://support.microsoft.com/kb/159672

5th hit scott noone and osr staff

http://www.osronline.com/article.cfm?article=542

real experts are trying to explain them in google what part of it you
cant understand
a little show and tell me might yield better answers

as far as stack frame is concerned
simply stating it is a lifo (last in first out ) list

suppose you have a call say call sccobydoo calling barbiedoll calling
gijoe and gijoe calling jerry

when you set a breakpoint on say jerry() and issue a kp :slight_smile: you can see
how it will look like and this is call stack

ChildEBP RetAddr
0013ff20 0040117a callstack!jerry(void) [c:\documents and
settings\admin\my documents\visual studio
2008\projects\callstack\callstack.c @ 38]

0013ff28 0040114f callstack!gijoe(char * fii = 0x004233e0 "iam scooby
doo calling barbiedoll i am barbiedoll i will now call gijoe i am
gijoe i will call my rat ")+0x1a [c:\documents and settings\admin\my
documents\visual studio 2008\projects\callstack\callstack.c @ 35]

0013ff34 00401117 callstack!barbiedoll(char * faa = 0x004233e0 "iam
scooby doo calling barbiedoll i am barbiedoll i will now call gijoe i
am gijoe i will call my rat ")+0x1f [c:\documents and
settings\admin\my documents\visual studio
2008\projects\callstack\callstack.c @ 28]

0013ff58 0040107b callstack!scoobydoo(char * foo = 0x0013ff64 "iam
scooby doo ")+0x67 [c:\documents and settings\admin\my
documents\visual studio 2008\projects\callstack\callstack.c @ 22]

0013ff78 004015e3 callstack!main(void)+0x3b [c:\documents and
settings\admin\my documents\visual studio
2008\projects\callstack\callstack.c @ 13]
0013ffc0 7c817077 callstack!__tmainCRTStartup(void)+0xfb
[f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c @ 266]

0013fff0 00000000 kernel32!BaseProcessStart+0x23

On 2/1/12, xxxxx@gmail.com wrote:
> Hi.
>
> I’ve got very nooby question, but since there is a lot of professionals I
> belive you will be able to answer to my question.
>
> I’m trying to understand windows nomenclature for stacks, callstacks and
> trap frames …
> 1. My first request to you is to give me some tutorial, or simple answer
> what exactly trap frame is I belive it is not same as stack frame right?
> 2. I would like to understand also what are ‘connections’ between stack,
> trap frame and call stack?
>
> 3. In kernelapi there is something liek this:
> http://msdn.microsoft.com/en-us/library/windows/hardware/ff549299(v=vs.85).aspx
> but doc does not says anything about if it deals with kernel or user mode
> stack? (I read somewhere that there are kernel part of stack and user mode
> stack)
>
> 4. How in WinDbg get user callstack. I;ve tried .process [PROCESS], .thread
> [THREAD] and then kv but I think it still is bad.
>
> Thank you for patience and responses.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

3

xxxxx@gmail.com wrote:

I’ve got very nooby question, but since there is a lot of professionals I belive you will be able to answer to my question.

I’m trying to understand windows nomenclature for stacks, callstacks and trap frames …

  1. My first request to you is to give me some tutorial, or simple answer what exactly trap frame is I belive it is not same as stack frame right?

Yes. A stack frame is a software convention. The hardware does not
dictate what goes in there. It’s just a chunk of stack, allocated by a
function for its own use. A trap frame is created when a hardware
exception occurs, and the contents are created by the processor.
Windows extends the trap frame to include other information needed for
debugging, but the basic part comes from the processor.

http://www.dumpanalysis.org/blog/index.php/2007/07/15/interrupts-and-exceptions-explained-part-4/

  1. I would like to understand also what are ‘connections’ between stack, trap frame and call stack?

The terms are only slightly related. A “stack” is just a chunk of
memory starting at the stack pointer. Stack frames are placed on the
stack, and trap frames are placed on the stack. The term “call stack”
is usually used to refer to the list of function calls that got us where
we are now. If everyone follows the conventions of by Microsoft
compilers, it is possible to start from the current stack pointer and
frame pointer (esp and ebp), and figure out who called up, and who
called them, and who called them, and so on. That’s the “call stack”.

  1. In kernelapi there is something liek this: http://msdn.microsoft.com/en-us/library/windows/hardware/ff549299(v=vs.85).aspx but doc does not says anything about if it deals with kernel or user mode stack? (I read somewhere that there are kernel part of stack and user mode stack)

Why would you need this?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

4

> 1. My first request to you is to give me some tutorial, or simple answer what exactly trap frame is I

On-stack data structure with the saved registers created as a result of the processor trap - i.e. hardware interrupt, syscall or exception like the page fault.

  1. I would like to understand also what are ‘connections’ between stack, trap frame and call stack?

Stack == call stack.
Trap frame is on the stack, only used to enter the kernel (or re-enter it).

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com