Windbg "Processes and Threads" window doesn't change context when kernel debugging -
my "processes , threads" window stuck on 000:f0f0f0f0 ntkrnlpa.exe.
i tried changing context in various ways, none of affected window.
my actions:
kd> !process 0 0 notepad.exe process 821ff378 sessionid: 0 cid: 0358 peb: 7ffd7000 parentcid: 05e0 dirbase: 090801a0 objecttable: e18fb7b8 handlecount: 132. image: notepad.exe kd> .process /i 821ff378 need continue execution (press 'g' <enter>) context switched. when debugger breaks in again, in new process context. kd> g break instruction exception - code 80000003 (first chance) nt!rtlpbreakwithstatusinstruction: 80527bdc cc int 3 i'd expect "processes , threads" window show me notepad.exe threads. why wouldn't work?
the processes , threads window displays list of processes being debugged. threads in process appear under each process. if debugger attached multiple systems, systems shown @ top level of tree, processes subordinate them, , threads subordinate processes.
so processes , threads window shows processes/threads being debugged or debugger attached to, showing when attached kernel.
even if change process context in debugger, still attached kernel, not process. process not show in window.
Comments
Post a Comment