.ecxr

Play .ecxr
Sign in to queue

Description

The .ecxr command changes to the context that is associated with the dump's exception. It displays the registers at that context.

Use .cxr to reset the context to the default context.

In general, start the debugging of a dump file by executing .exr -1, .ecxr and k. And then use !analyze -v.

Additional Resources:

Note: Also supported as ".excr" due to the high occurrence of typos.

Embed

Download

The Discussion

  • User profile image
    eschwabe

    this might be a stupid question, but why isn't !analyze -v automatically calling  .exr -1?
    Seems all the years I did debugging of crash dumps wrong, so thanks for this tip!

  • User profile image
    windev

    @eschwabe:!analyze considers the last exception record (it does it through the API : IDebugControl3::GetLastEventInformation) - you won't see it running the command.

    If you ever find a case where !analyze doesn't seem to be considering it, email us and we'll look into it.

  • User profile image
    eschwabe

    @windev: I'm referring to the comment:
    "In general, start the debugging of a dump file by executing .exr -1, .ecxr and k. And then use !analyze -v."
    which seems to contratict your last comment.
    So it IS already doing this automatically?

  • User profile image
    windev

    As a user, look at the .exr -1, .ecxr and k output.

    !analyze does the same (via APIs) thing internally to decide what type of analysis to run.

    You can jump to the "!analyze -v" output, if you want, and skip the other commands -- it's easier to understand the "!analyze -v" output if you have some context to base it on.

Add Your 2 Cents