Search code examples
windbgwindows-kernel

How to display user-mode stack of current kernel-mode context?

Suppose I'm broken into Kernel Debugger, during a system call or an IOCTL that started from user mode. I want to see the full stack - starting from user mode and switching to kernel mode.

I know some of the pieces:

  • I can list all the processes with !process 0 0, and see the threads inside them. Or, drowse using !dml_proc.
  • If I know the current usermode thread, I can switch to it and see the whole start: !thread <usermode_thread> 15.

But how do I tie them together? Specifically:

  1. How do I know the current usermode thread?
  2. Can I retrieve it programatically, so I can have a one-liner !thread <some_magic> 15?
Solution

  • WinDbg keeps track of the current thread in both user mode as well as kernel mode in the pseudo register @$thread, and current process in the pseudo register @$proc.

    To see current thread stack: !thread @$thread 0x1f.
    This is the full stack, starting from _RtlUserThreadStart up to the last api which usually would be SwapContext() if the thread ceded execution.

    To see current process with all its threads' stacks: !process @$proc 0x1f

    here is a complete current threads stack spat out by both commands

    !proc @$proc 1f as well as !thread @$thread 1f

    the first will print the callstack of all threads of a specific process
    the second will print the call stack of a specific currently running thread

    you can notice the wait status as RUNNING on the first line of Threads output

    :\>head -2 sample.txt
kd> !process @$proc 0x17
PROCESS 84efc748  SessionId: 0  Cid: 0470    Peb: 7ffdc000  ParentCid: 01e8

:\>wc -l sample.txt
517 sample.txt

:\>grep THREAD  sample.txt
        THREAD 84efcb60  Cid 0470.0474  Teb: 7ffdf000 Win32Thread: ff9f1c00 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 84f166b8  Cid 0470.0478  Teb: 7ffde000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Alertable
        THREAD 85303820  Cid 0470.0490  Teb: 7ffd9000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 85307bb0  Cid 0470.0494  Teb: 7ffd8000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 853064e8  Cid 0470.0498  Teb: 7ffd7000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 84e71d48  Cid 0470.049c  Teb: 7ffd6000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 8530eb80  Cid 0470.04a8  Teb: 7ffda000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 85371030  Cid 0470.0538  Teb: 7ffd4000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Alertable
        THREAD 8538ea08  Cid 0470.0588  Teb: 7ffad000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 853d6310  Cid 0470.05a4  Teb: 7ffaa000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Alertable
        THREAD 8540fa78  Cid 0470.06bc  Teb: 7ffaf000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
        THREAD 84173030  Cid 0470.0740  Teb: 7ffa6000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
        THREAD 84f77990  Cid 0470.0174  Teb: 7ffdd000 Win32Thread: 00000000 RUNNING on processor 0
THREAD 84f77990  Cid 0470.0174  Teb: 7ffdd000 Win32Thread: 00000000 RUNNING on processor 0

:\>grep !thread sample.txt
kd> !thread @$thread 1f

:\>grep -A 2 !thread sample.txt
kd> !thread @$thread 1f
THREAD 84f77990  Cid 0470.0174  Teb: 7ffdd000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating

:\>

    the full call stack of a currently running thread broken on NtDeviceIoControlFile 

    kd> !thread @$thread 1f
THREAD 84f77990  Cid 0470.0174  Teb: 7ffdd000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap                 919b0008
Owning Process            84efc748       Image:         svchost.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      49461          Ticks: 1 (0:00:00:00.010)
Context Switch Count      659            IdealProcessor: 0             
UserTime                  00:00:00.040
KernelTime                00:00:03.314
Win32 Start Address ntdll!TppWorkerThread (0x770403e7)
Stack Init 8c0e3fd0 Current 8c0e3bf8 Base 8c0e4000 Limit 8c0e1000 Call 00000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5

ChildEBP RetAddr  
8c0e3d04 8283787a nt!NtDeviceIoControlFile
8c0e3d04 770570b4 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8c0e3d34)
0292f518 77055864 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0292f51c 76dd14c9 ntdll!ZwDeviceIoControlFile+0xc (FPO: [10,0,0])
0292f560 76dd15f9 NSI!NsiIoctl+0x5d (FPO: [Non-Fpo])
0292f584 76dd15c7 NSI!NsiEnumerateObjectsAllParametersEx+0x23 (FPO: [Non-Fpo])
0292f5d0 718718e2 NSI!NsiEnumerateObjectsAllParameters+0x79 (FPO: [Non-Fpo])
0292f620 71871858 ncsi!CNcsiNsiTable::AllocateAndGetTable+0x51 (FPO: [Non-Fpo])
0292f644 718717c6 ncsi!UpdateInterfaceStatsByFamily+0xb0 (FPO: [Non-Fpo])
0292f664 71871e49 ncsi!UpdateInterfaceStats+0x26 (FPO: [Non-Fpo])
0292f694 71871d4e ncsi!PassiveProbe+0x6f (FPO: [Non-Fpo])
0292f6f4 718715d5 ncsi!NcsiUpdateConnectivityStatusList+0x4a1 (FPO: [Non-Fpo])
0292f6f8 7704112c ncsi!NcsiUpdateConnectivityStatusListTimer+0x5 (FPO: [3,0,0])
0292f71c 77040842 ntdll!TppTimerpExecuteCallback+0x10f (FPO: [Non-Fpo])
0292f87c 756f3c45 ntdll!TppWorkerThread+0x572 (FPO: [Non-Fpo])
0292f888 770737f5 kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])
0292f8c8 770737c8 ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])
0292f8e0 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])