Jaa


Locating the file that a function (not on the stack) was written in

This question came up in one of the internal aliases a couple days ago.  While debugging, how do I find the source for a particular function that is not on the stack?  There are a couple caveats to consider first:

  1. You must have symbols that include source information (public symbols have this information stripped out of them)
  2. You must have turned on loading source information.

To satisfy #2, first run .lines -e and then you have several choices:

  • use ln with name of the function
    • 0:000> ln RuntimeTest!CUIElementName::CUIElementName
      d:\dev\acw\enduser\nuiux\acw\activecontentwizard\unmanaged\property.cpp(1593)
      (00857050) RuntimeTest!CUIElementName::CUIElementName | (008570e0) RuntimeTest!CUIElementName::AddRef
      Exact matches:
      RuntimeTest!CUIElementName::CUIElementName (void)
  • use u with the name of the function
    • 0:000> u RuntimeTest!CUIElementName::CUIElementName
      RuntimeTest!CUIElementName::CUIElementName [d:\dev\acw\enduser\nuiux\acw\activecontentwizard\unmanaged\property.cpp @ 1593]:
      00857050 8bff mov edi,edi
      00857052 55 push ebp
      ...
  • use lsa with the name of the function and then lsc
    • 0:000> lsa RuntimeTest!CUIElementName::CUIElementName
      ...
      1590: }
      1591:
      1592: CUIElementName::CUIElementName()
      > 1593: {
      ...
      0:000> lsc
      Current: dev\acw\enduser\nuiux\acw\activecontentwizard\unmanaged\property.cpp(1599)