WinDbg : The Difference Between The Dot (.) & The Arrow (->) In The dt Command
Commands used:
We have seen that the dot (.) after the name of a structure member name will make the dt command expand the sub-structure.
kd> dt nt!_EPROCESS pcb.
+0x000 Pcb :
+0x000 Header : _DISPATCHER_HEADER
+0x010 ProfileListHead : _LIST_ENTRY
+0x018 DirectoryTableBase : Uint4B
<Output Snipped to Save Space>
The same seem to be achieved with the arrow (->) as well.
kd> dt nt!_EPROCESS pcb->*
+0x000 Pcb :
+0x000 Header : _DISPATCHER_HEADER
+0x010 ProfileListHead : _LIST_ENTRY
+0x018 DirectoryTableBase : Uint4B
<Output Snipped to Save Space>
So The question arises what then is the difference, if at all between these. Well, on the first level a single . is equivalent to ->*. The differences arise with multiple levels.
. (dot) will recursively expand structures within structures and can be used like ...... (dot dot dot dot). Four dots in a row will expand till the 4th level nested structure, while -> will deference a pointer and you may need a name for it.
In the below examples we will be using the pseudo register $Proc. To learn more about pseudo registers, please read this post.
lkd> $nodot
lkd> dt nt!_EPROCESS @$proc -y pc.H
+0x000 Pcb :
+0x000 Header : _DISPATCHER_HEADER
lkd> $single dot
lkd> dt nt!_EPROCESS @$proc -y pc.H.
+0x000 Pcb :
+0x000 Header :
+0x000 Type : 0x3 ''
+0x001 Absolute : 0 ''
+0x002 Size : 0x1b ''
+0x003 Inserted : 0 ''
+0x004 SignalState : 0n0
+0x008 WaitListHead : _LIST_ENTRY [ 0x866dd6d0 - 0x866dd6d0 ]
lkd> $single dot is equivalent to ->*
lkd> dt nt!_EPROCESS @$proc -y pc.H->*
+0x000 Pcb :
+0x000 Header :
+0x000 Type : 0x3 ''
+0x001 Absolute : 0 ''
+0x002 Size : 0x1b ''
+0x003 Inserted : 0 ''
+0x004 SignalState : 0n0
+0x008 WaitListHead : _LIST_ENTRY [ 0x866dd6d0 - 0x866dd6d0 ]
lkd> $double dot will expand _list_entry
lkd> dt nt!_EPROCESS @$proc -y pc.H..
+0x000 Pcb :
+0x000 Header :
+0x000 Type : 0x3 ''
+0x001 Absolute : 0 ''
+0x002 Size : 0x1b ''
+0x003 Inserted : 0 ''
+0x004 SignalState : 0n0
+0x008 WaitListHead : [ 0x866dd6d0 - 0x866dd6d0 ]
+0x000 Flink : 0x866dd6d0 _LIST_ENTRY [ 0x866dd6d0 - 0x866dd6d0 ]
+0x004 Blink : 0x866dd6d0 _LIST_ENTRY [ 0x866dd6d0 - 0x866dd6d0 ]
lkd> dt nt!_EPROCESS @$proc -y pc.H->W.
+0x000 Pcb :
+0x000 Header :
+0x008 WaitListHead : [ 0x866dd6d0 - 0x866dd6d0 ]
+0x000 Flink : 0x866dd6d0 _LIST_ENTRY [ 0x866dd6d0 - 0x866dd6d0 ]
+0x004 Blink : 0x866dd6d0 _LIST_ENTRY [ 0x866dd6d0 - 0x866dd6d0 ]
lkd> dt nt!_EPROCESS @$proc -y pc.H->W->*
+0x000 Pcb :
+0x000 Header :
+0x008 WaitListHead : [ 0x866dd6d0 - 0x866dd6d0 ]
+0x000 Flink : 0x866dd6d0 _LIST_ENTRY [ 0x866dd6d0 -
0x866dd6d0 ]
+0x004 Blink : 0x866dd6d0 _LIST_ENTRY [ 0x866dd6d0 -
0x866dd6d0 ]
lkd> dt nt!_EPROCESS @$proc -y pc.H->W..
+0x000 Pcb :
+0x000 Header :
+0x008 WaitListHead : [ 0x866dd6d0 - 0x866dd6d0 ]
+0x000 Flink :
+0x004 Blink :
Cannot find specified field members
No comments:
Post a Comment