K - Display Stack Trace from Address

Display the stack-trace from a given stack frame address.

Syntax:

─┬── K  ──┬──┬──────────────────┬─┬──────────────────────┬────
   ├── KS ──┤  └── stack-frame  ──┘ └── selector:offset  ──┘
   └── KB ──┘

Parameters:

K

Display stack frame trace assuming the default operation size from the code descriptor specified by selector:offset
KS
Display frame trace assuming an operation size of 16-bits (small-model).
KB
Display frame trace assuming an operation size of 32-bits (big-model).
stack-frame
Address of the starting stack-frame. If not specified then this defaults to the current SS:EBP or SS:BP as set by the last register display.

See the R and .R commands for information on changing the default register values.

An address expression may be specified.

selector:offset
The selector:offset address of the code that is in effect when the starting Stack-frame address was created. If not specified this defaults to the current CS:EIP or CS:IP as displayed by the

See the R command.

The code selector associated with this address is used for two purposes:

• To determine the default operand size in effect from the code segment descriptor.

• To attempt to distinguish between near and far calls at the starting stack-frame address.

Results & Notes:

The K command displays the stack trace, threading through the BP or EBP chain until either an invalid chain pointer is encountered or the command is interrupted by the user. For each stack-frame, the return address and for parameter words or double-words are displayed. The symbol associated with the return address is displayed after the parameter words. An example is given below:

-------------------------------------------------------------------------------##.S 8
##.R
eax=c7c00000 ebx=00000014 ecx=003acd7 edx=0000aff7 esi=00030bff edi=00030000
eip=0000272d esp=0003f8b8 ebp=0003f8c0 iopl=2 -- -- -- nv up ei ng nz na pe nc
cs=d02f ss=001f ds=aff7 es=be47 fs=150b gs=0000  cr2=1701d000  cr3=001d9000
doscall1:CONFORM16:postDOSSEMWAIT:
d02f:0000272d c9             leave
##K SS:BP CS:IP

bdef:0000711e ffff ffff 06d6 0a23 SEEPSMQ + 67
bdef:0000e1df ffff ffff 0bff f91c GETMSGNOINPUT + 4a
be1f:00000271 8001 ffff 0000 0000 THK16_CALLUSERTHUNKPROC + 12
be1f:00000003 05ae 0001 0001 0003 THUNKTOINITMOVECURSOR + 3
0020:00000003 0001 0001 0000 0010
0020:00000000 02af 1a03 0197 0000
##-------------------------------------------------------------------------------

Notes

• The K command is insensitive to unconventional use of the stack, such as where subroutine returns are effected explicitly by setting the stack pointer and jumping back to the calling code or in optimised code where the EBP or BP registers are not used as stack-frame pointers.

  Such possibilities exist within the system when for example the kernel returns to user code and also within some Presentation Manager components.

• No attempt is made to trace correctly through thunking layers where the default operand size changes.

• The stack trace is insensitive to any explicit segment operand overrides that may be active.

• No attempt is made to examine the descriptor of the SS register to determine whether EBP or BP should be used. In much 32-bit code both the 16-bit and 32-bit data descriptors are created by the system for calls to 16-bit subroutines.

  In the example above the stack-frame address has been explicitly overridden to use BP since the 16-bit stack selector (1f) is in effect rather than the 32-bit 53 selector.

• Unlike the default stack-frame address the default code selector:offset is taken
from the register values on entry to the Kernel Debugger.

Warning:

In consequence of these points it recommended that the stack-frame and code selector:offset addresses be explicitly coded when using the K command, as in the example above. In addition the stack trace should be verified with a memory dump of the stack.

---

[Back: J - Execute Commands Conditionally]
[Next: L - List Maps, Groups and Symbols]