What does windbg "kd" command do?
I ran kd by mistake and got some output that integrated me, a link to a line of code in my module that I can't see in the call stack of any thread. The lines weren't the start of the method, so I don't think the reference to the function pointer, but perhaps the result of an exception held in memory ??? Of course this is what I'm looking for ...
Update:
Exception stack trace:
0:000> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
0174f168 734ea84f 2cb9e950 00000000 2cb9e950 kernel32!LoadTimeZoneInformation+0x2b
0174f1c4 734ead92 00000022 00000001 000685d0 msvbvm60! RUN_INSTMGR::ExecuteInitTerm+0x178
0174f1f8 734ea9ee 00000000 0000002f 2dbc2abc msvbvm60! RUN_INSTMGR::CreateObjInstanceWithParts+0x1e4
0174f278 7350414e 2cb9e96c 00000000 0174f2f0 msvbvm60! RUN_INSTMGR::CreateObjInstance+0x14d
0174f2e4 734fa071 00000000 2cb9e96c 0174f2fc msvbvm60!RcmConstructObjectInstance+0x75
0174f31c 00976ef1 2cb9e950 00591bc0 0174fddc msvbvm60!__vbaNew+0x21
and into our code (create a new derived class Form)
dds output:
0:000> dds esp-0x40 esp+0x100
0174f05c 00000000
0174f060 00000000
0174f064 00000000
0174f068 00000000
0174f06c 00000000
0174f070 00000000
0174f074 00000000
0174f078 00000000
0174f07c 00000000
0174f080 00000000
0174f084 00000000
0174f088 00000000
0174f08c 00000000
0174f090 00000000
0174f094 00000000
0174f098 00000000
0174f09c 007f4f9b ourDll!formDerivedClass::Form_Initialize+0x10b [C:\Buildbox\formDerivedClass.frm @ 1452]
etc.
which appears to indicate that Initialization is being called even though it is not on the stack trace of either this exception or any of the threads. As expected, this could all be a mismatch between pdbs and dll, but it seems like a coincidence that we ended up in the correct classes and methods
a source to share
Kd stands for "stack dump". From the documentation:
The kd command displays the original data stack. Each DWORD value is mapped to a separate line. Symbol information is displayed for these strings, along with the corresponding symbols. This format produces a more verbose listing than other k * commands. The kd command is equivalent to the dds (display memory) command, which uses the stack address as its argument.
Try .hh to get debugger help from inside ntsd / windbg.
See also "dds esp-0x40 esp + 0x80"
a source to share
Sorry, but it looks like you actually controlled the "kb" command - with "B", not with "D". What appears in the previous session and the examples at http://www.debuginfo.com/articles/easywindbg.html will no doubt produce a similar output ...
a source to share