Is there a way to dump the individual arguments of va_list in windbg? -
is there way dump arguments in va_list in windbg given format string , starting address of va_list?
i dumping content of stack using command dd esp
(for x86) or dq rsp
(for x64). knowing starting address of va_list makes bit easier locate place in stack vararg block begins, can either guess or calculate knowing sizes of regular (non-vararg parameters) function.
here annotated example x86. function beeing called:
printf("%d %o %g %s %c", 101, 201, 301.0, "401-string", '5');
in debugger:
0:000> bp msvcr100d!printf 0:000> g breakpoint 1 hit eax=00000001 ebx=00000000 ecx=2549afc4 edx=00000000 esi=002ceeb8 edi=002cf040 eip=0ff57ee0 esp=002cee98 ebp=002cf04c iopl=0 nv ei pl nz ac po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000212 msvcr100d!printf: 0ff57ee0 8bff mov edi,edi 0:000> dd /c1 esp 002cee98 01365cee // return address 002cee9c 0137d6e8 // pointer format string "%d %o %g %s %c" --> next follows our variable arguments 002ceea0 00000065 // first vararg argument, int 101 002ceea4 000000c9 // second vararg argument, int 201 002ceea8 00000000 // third vararg argument, double 301.0, occupies 2 slots in stack 002ceeac 4072d000 // third argument continues 002ceeb0 0137d70c // fourth vararg argument, pointer string 002ceeb4 00000035 // fifth vararg argument, 8-bit character (still occupies 4 bytes in stack) 002ceeb8 25b87244 002ceebc 002cf254 002ceec0 0041c520 002ceec4 00000000 ...
for other functions similar, because functions use variable number of arguments have following __cdecl calling convention, find same type of layout of parameters in stack.
Comments
Post a Comment