Is there a way to dump the individual arguments of va_list in windbg? -


is there way dump arguments in va_list in windbg given format string , starting address of va_list?

i dumping content of stack using command dd esp (for x86) or dq rsp (for x64). knowing starting address of va_list makes bit easier locate place in stack vararg block begins, can either guess or calculate knowing sizes of regular (non-vararg parameters) function.

here annotated example x86. function beeing called:

printf("%d %o %g %s %c", 101, 201, 301.0, "401-string", '5'); 

in debugger:

0:000> bp msvcr100d!printf 0:000> g breakpoint 1 hit eax=00000001 ebx=00000000 ecx=2549afc4 edx=00000000 esi=002ceeb8 edi=002cf040 eip=0ff57ee0 esp=002cee98 ebp=002cf04c iopl=0         nv ei pl nz ac po nc cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000212 msvcr100d!printf: 0ff57ee0 8bff            mov     edi,edi 0:000> dd /c1 esp 002cee98  01365cee  // return address 002cee9c  0137d6e8  // pointer format string "%d %o %g %s %c" --> next follows our variable arguments 002ceea0  00000065  // first vararg argument, int 101 002ceea4  000000c9  // second vararg argument, int 201 002ceea8  00000000  // third vararg argument, double 301.0, occupies 2 slots in stack 002ceeac  4072d000  // third argument continues 002ceeb0  0137d70c  // fourth vararg argument, pointer string 002ceeb4  00000035  // fifth vararg argument, 8-bit character (still occupies 4 bytes in stack) 002ceeb8  25b87244 002ceebc  002cf254 002ceec0  0041c520 002ceec4  00000000 ...

for other functions similar, because functions use variable number of arguments have following __cdecl calling convention, find same type of layout of parameters in stack.


Comments

Popular posts from this blog

c# - SharpSVN - How to get the previous revision? -

c++ - Is it possible to compile a VST on linux? -

url - Querystring manipulation of email Address in PHP -