Note that there are some explanatory texts on larger screens.

plurals
  1. POhow can I find native exceptions in an x64 stack?
    text
    copied!<p>I've been using WinDbg to debug dump files for a while now.<br> There's a nice "trick" that works with x86 native programs, you can scan the stack for the <code>CONTEXT_ALL</code> flags (<strong>0x1003f</strong>).</p> <p>In x64 the <code>CONTEXT_ALL</code> flags apparently don't contain <strong>0x1003f</strong> ...</p> <p>Now the problem is that sometimes when you mix native with managed code, the regular methods of finding exceptions (like .exc or .lastevent).</p> <p>What is the equivalent of this <strong>0x1003f</strong> in x64 ? is there such a constant ?</p> <p><strong>EDIT:</strong></p> <p>BTW, if you were wondering, in theory it should have been <strong>10003f</strong> because of the definitions:</p> <pre><code>#define CONTEXT_I386 0x00010000 #define CONTEXT_AMD64 0x00100000 #define CONTEXT_CONTROL 0x00000001L // SS:SP, CS:IP, FLAGS, BP #define CONTEXT_INTEGER 0x00000002L // AX, BX, CX, DX, SI, DI #define CONTEXT_SEGMENTS 0x00000004L // DS, ES, FS, GS #define CONTEXT_FLOATING_POINT 0x00000008L // 387 state #define CONTEXT_DEBUG_REGISTERS 0x00000010L // DB 0-3,6,7 #define CONTEXT_EXTENDED_REGISTERS 0x00000020L // cpu specific extensions #define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS) #define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS) #define CONTEXT_I386_FULL CONTEXT_I386 | CONTEXT_FULL #define CONTEXT_I386_ALL CONTEXT_I386 | CONTEXT_ALL #define CONTEXT_AMD64_FULL CONTEXT_AMD64 | CONTEXT_FULL #define CONTEXT_AMD64_ALL CONTEXT_AMD64 | CONTEXT_ALL </code></pre> <p>But it's not...</p>
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload