Display the user registers for a given thread slot. Set default addresses for E command, D command, K command and U command.
Applicable to the Dump Formatter only, the default adressing mode is not set according to the VM flags of the EFLAGS register but is assumed always to be in protect mode. This has been corrected from fix pack 29 of Wapr 3.0 and base Warp 4.0.
Syntax:
────.R ───────────────────────┬──────────┬────────────────────
├── # ──┤
├── * ──┤
└── slot ──┘
Parameters:
slot
The following short-hand may be used for the slot number:
_TaskNumber
If no slot number is given then the debugger's default slot number is assumed.
Results & Notes:
Registers are displayed and register mnemonics are assigned the values displayed for use in address expressions and operands of other Kernel Debugger and Dump Formatter commands.
The register information is obtained as follows:
Under the Kernel Debugger, if the displayed slot is the current system slot and the system is not in kernel mode (that is, Indos¬=1) then the hardware register values save by the debugger are displayed.
Otherwise the registers are extracted from the from the ring 0 stack frame base pointed to by TCB_pFrameBase (TCB + 0x3c) for the thread slot in question.
The ring 0 stack frame base is created when the threads makes a transition from ring 2 or 3 to ring 0. This happens for a variety of reasons, such as issuing a call gate, trapping, pre-emption, interrupt, etc.. The format of the stack frame base depends on the reason for the ring 0 transition. TCB_pcriFrameType (TCB + 0x38) points to the CRI, which contains a table of RIPs. Each RIP entry is associated with a specific hardware register. The RIP contains the offset and length of the associated register saved in the stack frame base. See Client Register Information and Stack Frames for details of the CRI and RIP formats.
Note:
If the thread has never run out of kernel mode, as is the case with some internal threads, then the CRI is never updated. The .R command is not able to format the user registers. For these threads the R command should be used, but only when the thread in question is the current system thread. Because the R command is an alias to the .R under the Dump Formatter, there is no way the display the current registers for an internal thread under the Dump Formatter. The only recourse is to display the TSD for the thread and attempt to unravel the stack manually.
If an invalid thread slot number is given the the Kernel Debugger issues the following message: prompted with the command prompt.
Invalid task number: nnnn
The format of the .R command output depends on whether the RT command has been used to toggle register display to full or short form and also whether the Y 386ENV command has been used to toggle register interpretation into 286 or 386 mode. Examples of the various forms follow:
##rt ##.r 2c eax=f110099f ebx=00000001 ecx=0133fe4c edx=00000007 esi=0133ffec edi=00000000 eip=00000626 esp=0133fe20 ebp=0133fe88 iopl=2 -- -- -- nv up ei ng nz na pe nc cs=d02f ss=099f ds=0053 es=0053 fs=150b gs=0000 cr2=1581928c cr3=001d0000 gdtr=7c3e5000 1fff idtr=ffe00df0 03ff tr=0010 ldtr=0028 cr0=pg et ts em mp -- dr0=00000000 --e1- dr1=00000000 --e1- dr2=00000000 --e1- dr3=00000000 --e1- tr6=00000 v=0 d=00 u=00 w=00 c=w tr7=00000 ht=0 rep=0 dr6=-- -- -- dr7=-- -- 002c|d02f:00000626 66ead77a021a5b00 jmp 005b:1a027ad7 ##rt ##.r eax=00000000 ebx=00000014 ecx=0000abd7 edx=0000abd7 esi=00080bff edi=00080007 eip=0000272d esp=0000a668 ebp=0008a670 iopl=2 -- -- -- nv up ei ng nz na pe nc cs=d02f ss=0047 ds=abd7 es=d137 fs=150b gs=0000 cr2=1581928c cr3=001d0000 doscall1:CONFORM16:postDOSSEMWAIT: d02f:0000272d c9 leave ##y 386env ##.r 2c ax=099f bx=0001 cx=fe4c dx=0007 sp=fe20 bp=fe88 si=ffec di=0000 ip=0626 cs=d02f ds=0053 es=0053 ss=099f -- nv up ei ng nz na pe nc 002c|d02f:0626 66ead77a021a5b00 jmp 005b:1a027ad7 ## ##rt ##.r 2c ax=099f bx=0001 cx=fe4c dx=0007 sp=fe20 bp=fe88 si=ffec di=0000 ip=0626 cs=d02f ds=0053 es=0053 ss=099f -- nv up ei ng nz na pe nc gdtr=3e5000 1fff idtr=e00df0 03ff tr=0010 ldtr=0028 iopl=2 msw=ts em mp 002c|d02f:0626 66ead77a021a5b00 jmp 005b:1a027ad7 ##
Following the formatted register display, one line of disassembled code is displayed at the default disassembley address. See the U command for details on disassembling code.
Each of the fields has the following meaning:
General Registers
ax, bc, cx, dx, sp, bp, si, di
eax, ebx, ecx, edx, esp, ebp, esi, edi
Each is displayed with its value in hexadecimal.
cs, ds, es, fs, gs, ss
Each is displayed with its selector value in hexadecimal.
ip & eip
Each is displayed with its value in hexadecimal.
flags & eflags
These have their bit setting interpreted as follows:
┌────┬──────┬────┬──────────────────────────────┐ │Bit │Value │Flag│Description │ ├────┼──────┼────┼──────────────────────────────┤ │17 │1 │VM │Virtual 8086 Mode (EFLAGS │ │ │ │ │only) │ ├────┼──────┼────┼──────────────────────────────┤ │16 │0 │RF │Resume Flag - Disable Debug │ │ │ │ │Exceptions (EFLAGS only) │ ├────┼──────┼────┼──────────────────────────────┤ │14 │1 │NT │Nested Task │ ├────┼──────┼────┼──────────────────────────────┤ │11 │1 │OV │Overflow │ ├────┼──────┼────┼──────────────────────────────┤ │11 │0 │NV │¬Overflow │ ├────┼──────┼────┼──────────────────────────────┤ │10 │1 │DN │Direction Down │ ├────┼──────┼────┼──────────────────────────────┤ │10 │0 │UP │Direction Up │ ├────┼──────┼────┼──────────────────────────────┤ │9 │1 │EI │Enable Interrupts │ ├────┼──────┼────┼──────────────────────────────┤ │9 │0 │DI │Disable Interrupts │ ├────┼──────┼────┼──────────────────────────────┤ │7 │1 │NG │Negative Sign │ ├────┼──────┼────┼──────────────────────────────┤ │7 │0 │PL │Plus Sign │ ├────┼──────┼────┼──────────────────────────────┤ │6 │1 │ZR │Zero Result │ ├────┼──────┼────┼──────────────────────────────┤ │6 │0 │NZ │Non-zero Result │ ├────┼──────┼────┼──────────────────────────────┤ │4 │1 │AC │Auxiliary Carry │ ├────┼──────┼────┼──────────────────────────────┤ │4 │0 │NA │¬Auxiliary Carry │ ├────┼──────┼────┼──────────────────────────────┤ │2 │1 │PE │Parity Even │ ├────┼──────┼────┼──────────────────────────────┤ │2 │0 │PO │Parity Odd │ ├────┼──────┼────┼──────────────────────────────┤ │0 │1 │CY │Carry │ ├────┼──────┼────┼──────────────────────────────┤ │0 │0 │NC │¬Carry │ └────┴──────┴────┴──────────────────────────────┘
Bits 12 and 13 are the I/O Privilege Level bits. These are formatted as iopl=level.
Flags 14, 16 and 17 when reset are indicated by --. Memory Management Registers
gdtr=xxxxxxxx yyyy
cr0=
These have their bit setting interpreted as follows:
┌────┬──────┬────┬──────────────────────────────┐ │Bit │Value │Flag│Description │ ├────┼──────┼────┼──────────────────────────────┤ │31 │1 │PG │Paging Enabled │ ├────┼──────┼────┼──────────────────────────────┤ │4 │1 │ET │Extension Type Flag - x87 │ │ │ │ │support │ ├────┼──────┼────┼──────────────────────────────┤ │3 │1 │TS │Task Switch Flag │ ├────┼──────┼────┼──────────────────────────────┤ │2 │1 │EM │Emulation exception │ ├────┼──────┼────┼──────────────────────────────┤ │1 │1 │MP │Math Present │ ├────┼──────┼────┼──────────────────────────────┤ │0 │1 │PM │Protect Mode Enabled │ └────┴──────┴────┴──────────────────────────────┘
Reset flag bit are shown with --. cr2=
dr0 to dr3
dr0=llllllll glxnb dr1=llllllll glxnb dr2=llllllll glxnb dr3=llllllll glxnb
where llllllll is the breakpoint linear address and glxnb are dr7 and dr6 related flags.
The flags have th following interpretations:
g
R indicates an read breakpoint
W indicates an write breakpoint
┌────┬──────┬────┬──────────────────────────────┐ │Bit │Value │Flag│Description │ ├────┼──────┼────┼──────────────────────────────┤ │15 │1 │BT │Breakpoint triggered on task │ │ │ │ │switch │ ├────┼──────┼────┼──────────────────────────────┤ │14 │1 │BS │Breakpoint triggered on single│ │ │ │ │step. │ ├────┼──────┼────┼──────────────────────────────┤ │13 │1 │BD │Breakpoint on debug register │ │ │ │ │access/update. │ └────┴──────┴────┴──────────────────────────────┘
Flag bits not set are indicated by -- dr7=
┌────┬──────┬────┬──────────────────────────────┐ │Bit │Value │Flag│Description │ ├────┼──────┼────┼──────────────────────────────┤ │9 │1 │GE │Exact data matching enabled │ │ │ │ │for global breakpoints │ ├────┼──────┼────┼──────────────────────────────┤ │8 │1 │LE │Exact data matching matching │ │ │ │ │for local breakpoints │ └────┴──────┴────┴──────────────────────────────┘
Flag bits not set are indicated by -- Test Registers
tr6=lllll v=v d=dd u=uu w=ww c=c
lllll is the linear page address.
v is tr6 flag bit 11, the valid bit.
dd are tr6 flag bits 10 and 9.
uu are tr6 flag bits 8 and 7.
w are tr6 flag bits 6 and 5.
c is set as follows:
r
ppppp is the tr7 physical frame address.
h is flag bit 4 value. This is the hit or PL bit.
r are tr7 flag bits 3 and 2. These are the report or REP bits.
The following INTEL(R) publications should be consulted for definitive information on processor registers:
Intel486(TM) Microprocessor Family Programmer's Reference Manual
Pentium(TM) Processor User's Manual