Windbg disassemble function (uf) command needs some formatting
I made uf command in windbg after attaching notepad.exe The command was uf notepad! WinMain I got the following output
0:000> uf notepad!WinMain
notepad!WinMain:
0021138d mov edi,edi
0021138f push ebp
00211390 mov ebp,esp
00211392 sub esp,1Ch
00211395 push esi
00211396 push edi
00211397 push 6
002113c8 test eax,eax
002113ca jl notepad!WinMain+0x118 (00211c93)
notepad!WinMain+0x43:
002113d0 push ebx
002113d1 push dword ptr [ebp+14h]
002113d4 push edi
002113d5 call notepad!SkipProgramName (00213170)
002113e5 je notepad!WinMain+0x10e (00211ca9)
notepad!WinMain+0x5e:
002113eb push esi
002113ec push esi
002113ed call dword ptr [notepad!_imp__GetCurrentProcessId (00211084)]
etc. If you notice after each jump command, it will create a new block, for example
002113ca jl notepad!WinMain+0x118 (00211c93)
notepad!WinMain+0x43:
and at
002113e5 je notepad!WinMain+0x10e (00211ca9)
notepad!WinMain+0x5e:
So what I wanted to know about a setup in WinDbg where I can omit creating a new block on every hop to parse the function. Why can't I get the output the way I get it with the U command?
So I am looking for an option like this
002113c8 test eax,eax002113ca
jl notepad!WinMain+0x118 (00211c93)
**blank line omitted**
**notepad!WinMain+0x43:** omitted**
002113d0 push ebx002113d1 push dword ptr [ebp+14h]
Any help?
a source to share
because functional code is potentially spread throughout the entire section of code (all the way down to the linker to decide where to put what and generally it ends up moving the parts that get done the most at the top)
now u doesn't care if you are interested in a particular function - it just dumps the instructions sequentially, and uf has to look for all the relevant locks and formats them together to make it look like a coherent function.
edit: unfortunately (as far as I know) there is no direct customization for windbg for your needs - here you will probably have to resort to some kind of post-processing (a pretty-typed script to remove the blank lines and whatever you need).
a source to share