Example Example -Stack Size for a Thread
0:003> !teb
TEB at 0000000000865000
ExceptionList: 0000000000000000
StackBase: 0000000007bf0000
StackLimit: 0000000007bec000
SubSystemTib: 0000000000000000
FiberData: 0000000000001e00
ArbitraryUserPointer: 0000000000000000
Self: 0000000000865000
EnvironmentPointer: 0000000000000000
ClientId: 0000000000005b88 . 0000000000000714
RpcHandle: 0000000000000000
Tls Storage: 0000000000000000
PEB Address: 000000000085e000
LastErrorValue: 0
LastStatusValue: 0
Count Owned Locks: 0
HardErrorMode: 0
0:003> kv
# Child-SP RetAddr : Args to Child : Call Site
00 00000000`07befef8 00007ffc`8323536b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!DbgBreakPoint
01 00000000`07beff00 00007ffc`80d62774 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!DbgUiRemoteBreakin+0x4b
02 00000000`07beff30 00007ffc`831d0d51 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
03 00000000`07beff60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
0:003> dt ntdll!_TEB DbgBreakPoint 0000000000865000
Cannot find specified field members.
0:003> dt ntdll!_TEB DeallocationStack 0000000000865000
+0x1478 DeallocationStack : 0x00000000`07af0000 Void
0:003> !address esp
Mapping file section regions...
Mapping module regions...
Mapping PEB regions...
Mapping TEB and stack regions...
Mapping heap regions...
Mapping page heap regions...
Mapping other regions...
Mapping stack trace database regions...
Mapping activation context regions...
Usage: Stack
Base Address: 00000000`07bec000
End Address: 00000000`07bf0000
Region Size: 00000000`00004000 ( 16.000 kB)
State: 00001000 MEM_COMMIT
Protect: 00000004 PAGE_READWRITE
Type: 00020000 MEM_PRIVATE
Allocation Base: 00000000`07af0000
Allocation Protect: 00000004 PAGE_READWRITE
More info: ~3k
Content source: 1 (target), length: 108
0:003> ? 0000000007bf0000-0000000007bec000
Evaluate expression: 16384 = 00000000`00004000
0:003> ? 0000000007bf0000-0x00000000`07af0000
Evaluate expression: 1048576 = 00000000`00100000
0x004000 Our thread has 4 pages or 16KB of committed memory. 0x100000 Our thread has 256 pages or 1MB of reserved memory
Memory: Stack Growth Memory: Stack Growth
The ESP register points to the current stack location of a thread. If a program attempts to access an address within a guard page, the system raises a STATUS_GUARD_PAGE_VIOLATION(0x80000001) exception. A guard page provides a one-shot alarm for memory page
access. If a stack grows until the end of reserved memory, a STATUS_STACK_OVERFLOWis raised.
WinDbg Commands for Retrieving Call WinDbg Commands for Retrieving Call-Stack Information
kM
b == display the first three parameterspassed to each function
kb
v == display FPO information + calling convention kv
f == distance between adjacent frames to be displayed (useful to check stack consumption of each frame)
kf
locates all call-stacks that contain MySymbol !findstack MySymbol 2
display call stack for current thread k
P == full parameters for each function called kP
displays call-stacks for all of the threads in the current process
!uniqstack
Description
Example Example -UniqStack
0:003> !uniqstack
Processing 4 threads, please wait
. 0 Id: 5b88.12578 Suspend: 1 Teb: 00000000`0085f000 Unfrozen
Start: tamade!wmainCRTStartup (00007ff7`366a1280)
Priority: 0 Priority class: 32 Affinity: ff
# Child-SP RetAddr Call Site
00 00000000`007afb18 00007ffc`7f747217 ntdll!NtDelayExecution+0x14
01 00000000`007afb20 00007ff7`366a1070 KERNELBASE!SleepEx+0xa7
02 00000000`007afbc0 00007ff7`366a10b2 tamade!AllocateMemory+0x50 [c:\users\winne\documents\visual studio 2008\projects\tamade\tamade\tamade.cpp @ 12]
03 00000000`007afc00 00007ff7`366a1432 tamade!wmain+0x32 [c:\users\winne\documents\visual studio 2008\projects\tamade\tamade\tamade.cpp @ 19]
04 00000000`007afc30 00007ff7`366a128e tamade!__tmainCRTStartup+0x192 [f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crtexe.c @ 583]
05 00000000`007afca0 00007ffc`80d62774 tamade!wmainCRTStartup+0xe [f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crtexe.c @ 403]
06 00000000`007afcd0 00007ffc`831d0d51 KERNEL32!BaseThreadInitThunk+0x14
07 00000000`007afd00 00000000`00000000 ntdll!RtlUserThreadStart+0x21
. 1 Id: 5b88.107f0 Suspend: 1 Teb: 00000000`00861000 Unfrozen
Start: ntdll!TppWorkerThread (00007ffc`831a12c0)
Priority: 0 Priority class: 32 Affinity: ff
# Child-SP RetAddr Call Site
00 00000000`069efb38 00007ffc`831a1553 ntdll!NtWaitForWorkViaWorkerFactory+0x14
01 00000000`069efb40 00007ffc`80d62774 ntdll!TppWorkerThread+0x293
02 00000000`069efe50 00007ffc`831d0d51 KERNEL32!BaseThreadInitThunk+0x14
03 00000000`069efe80 00000000`00000000 ntdll!RtlUserThreadStart+0x21
. 3 Id: 5b88.714 Suspend: 1 Teb: 00000000`00865000 Unfrozen
Start: ntdll!DbgUiRemoteBreakin (00007ffc`83235320)
Priority: 0 Priority class: 32 Affinity: ff
# Child-SP RetAddr Call Site
00 00000000`07befef8 00007ffc`8323536b ntdll!DbgBreakPoint
01 00000000`07beff00 00007ffc`80d62774 ntdll!DbgUiRemoteBreakin+0x4b
02 00000000`07beff30 00007ffc`831d0d51 KERNEL32!BaseThreadInitThunk+0x14
03 00000000`07beff60 00000000`00000000 ntdll!RtlUserThreadStart+0x21
Total threads: 4
Duplicate callstacks: 1 (windbg thread #s follow):
2
WinDbg Commands for Memory Handling
Example – –Process Process’ ’s Memory Information
0:003> !address
BaseAddress EndAddress+1 RegionSize Type State Protect Usage
--------------------------------------------------------------------------------------------------------------------------
+ 0`00000000 0`00670000 0`00670000 MEM_FREE PAGE_NOACCESS Free
+ 0`00670000 0`00672000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]
+ 0`00672000 0`00680000 0`0000e000 MEM_FREE PAGE_NOACCESS Free
+ 0`00680000 0`00682000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]
+ 0`00682000 0`00690000 0`0000e000 MEM_FREE PAGE_NOACCESS Free
+ 0`00690000 0`006a8000 0`00018000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [API Set Map]
+ 0`006a8000 0`006b0000 0`00008000 MEM_FREE PAGE_NOACCESS Free
+ 0`006b0000 0`007a2000 0`000f2000 MEM_PRIVATE MEM_RESERVE Stack [~0; 5b88.12578]
0`007a2000 0`007a5000 0`00003000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE|PAGE_GUARD Stack [~0; 5b88.12578]
0`007a5000 0`007b0000 0`0000b000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Stack [~0; 5b88.12578]
+ 0`007b0000 0`007b4000 0`00004000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [System Default Activation Context Data]
+ 0`007b4000 0`007c0000 0`0000c000 MEM_FREE PAGE_NOACCESS Free
+ 0`007c0000 0`007c1000 0`00001000 MEM_MAPPED MEM_COMMIT PAGE_READONLY Other [Activation Context Data]
+ 0`007c1000 0`007d0000 0`0000f000 MEM_FREE PAGE_NOACCESS Free
+ 0`007d0000 0`007d1000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [............d...]
+ 0`007d1000 0`007e0000 0`0000f000 MEM_FREE PAGE_NOACCESS Free
+ 0`007e0000 0`007e2000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE <unknown> [................]
+ 0`007e2000 0`007f0000 0`0000e000 MEM_FREE PAGE_NOACCESS Free
+ 0`007f0000 0`00800000 0`00010000 MEM_MAPPED MEM_COMMIT PAGE_READWRITE Heap [ID: 3; Handle: 00000000007f0000; Type: Segment]
+ 0`00800000 0`0085e000 0`0005e000 MEM_PRIVATE MEM_RESERVE <unknown>
0`0085e000 0`0085f000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PEB [5b88]
0`0085f000 0`00861000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~0; 5b88.12578]
0`00861000 0`00863000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~1; 5b88.107f0]
0`00863000 0`00865000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~2; 5b88.14284]
0`00865000 0`00867000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~3; 5b88.714]
0`00867000 0`00a00000 0`00199000 MEM_PRIVATE MEM_RESERVE <unknown>
+ 0`00a00000 0`00a41000 0`00041000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Other [Stack Trace Database]
0`00a41000 0`021ff000 0`017be000 MEM_PRIVATE MEM_RESERVE Other [Stack Trace Database]
0`021ff000 0`02200000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE Other [Stack Trace Database]
+ 0`02200000 0`02201000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READONLY PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02201000 0`0222f000 0`0002e000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0222f000 0`02269000 0`0003a000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02269000 0`0226a000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0226a000 0`0226b000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0226b000 0`0226c000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0226c000 0`0226d000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0226d000 0`0226e000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0226e000 0`0226f000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0226f000 0`02270000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02270000 0`02271000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02271000 0`02272000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02272000 0`02273000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02273000 0`02274000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02274000 0`02275000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02275000 0`02276000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_NOACCESS PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02276000 0`02277000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02277000 0`02278000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02278000 0`02279000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02279000 0`0227a000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0227a000 0`0227b000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0227b000 0`0227c000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_NOACCESS PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0227c000 0`0227d000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0227d000 0`0227e000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0227e000 0`0227f000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0227f000 0`02280000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02280000 0`02281000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02281000 0`02282000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02282000 0`02283000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02283000 0`02284000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02284000 0`02285000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02285000 0`02286000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02286000 0`02287000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02287000 0`02288000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02288000 0`02289000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02289000 0`0228a000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0228a000 0`0228b000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0228b000 0`0228c000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0228c000 0`0228d000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0228d000 0`0228e000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_NOACCESS PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0228e000 0`0228f000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0228f000 0`02290000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02290000 0`02291000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02291000 0`02292000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02292000 0`02293000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02293000 0`02294000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02294000 0`02295000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02295000 0`02296000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02296000 0`02297000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02297000 0`02298000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02298000 0`02299000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02299000 0`0229a000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0229a000 0`0229b000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0229b000 0`0229c000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0229c000 0`0229d000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0229d000 0`0229e000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0229e000 0`0229f000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`0229f000 0`022a0000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`022a0000 0`022a1000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`022a1000 0`022a2000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`022a2000 0`022a3000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`022a3000 0`022a4000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`022a4000 0`022a5000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`022a5000 0`022a6000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`022a6000 0`02ccb000 0`00a25000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02ccb000 0`02ccc000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02ccc000 0`02ece000 0`00202000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02ece000 0`02ecf000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02ecf000 0`02ed0000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02ed0000 0`02ed1000 0`00001000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
0`02ed1000 0`02ed2000 0`00001000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 2201000; NormalHeap: 32a0000]
Enablestack traces and page heap for you application
–Start GFlags, select "Create user mode stack trace database" and“Enable page heap”for your image –Or from the command line: gflags.exe /i <IMAGE.EXE> +ust +hpa Restart your application and attach WinDbg