.I (DF) - Show Dump State

Display the dump state.

Syntax:

──── .I ──────────────────────────────────────────────────────

Parameters:

None.

Results & Notes:

This command displays the following summary information:

----------------------------------------------------------------------
#.i
PROCESS slot:1c Pid:0003 Ord:0013
PTDA    handle=0088 address=%7bcd5844
MTE     handle=018a address=%fdfadf78 (PMSHL32)
SMTE    address=%fc9a4c48
LDT     handle=0187 address=%7a597000
CODE:   user (cs:eip)#005b:17d679f2 cbargs=
STACKS: user (ss:esp)#0053:01382cbc(active)
        ring2(ss:esp)#09be:00004000(bottom)
        ring0 tcbframe=%7bbd4f54 bottom=%7bbd4f9c
----------------------------------------------------------------------

Each of the fields display has the following meaning:

slot:

The current thread slot at the time the dump was taken. This value is taken from the TaskNumber global variable.
Pid:
The current pid when the dump was taken. This value is taken from the Pid global variable.
Ord:
The Tid of the current thread at the time the dump was taken. This value is taken from the TCBOrdinal (TCB+ 0x0) of the current TCB.
handle=
The VMOB handle that represents the control block named to the left.

.I displays this information for the PTDA, MTE, SMTE and LDT associated with the current thread when the dump was taken.

See the .MO command form more information.

address=
The address of the object whose name and handle are given on the same line of display.
user (cs:eip)
The current user CS:EIP when the dump was taken. See the .R command for related information.
cbargs=
The call gate argument count if the current task has made a privilege level transition. See the .PU command for further information.
user (ss:esp)
The current user SS:ESP when the dump was taken. See the .R command
ring2(ss:esp)
The current ring 2 SS:ESP as saved in TCBCpl2_SS (TCB + 0x1bc) and TCBCpl2_ESP (TCB + 0x1b8) fields of the current TCB.
ring0 tcbframe=
The current (or last) kernel entry stack frame pointed to be TCB_pFrameBase (TCB + 0x3c) when the current thread made a call or transition to the kernel.
bottom=
The base of the ring 0 stack (in its all contexts addressable form) for the current thread.

---

[Back: .H - Display Dump File Header Information]
[Next: .K - Display User Stack Trace]