Windbg: what is the benefit of specifying pseudo register when using "dt" command

user_7307854 0
Viewed 81

When using the "Dislay Type" command in Windbg you have the option to specify a pseudo register. This will add the base address. However it is unclear to me what the benefit is of specifying the pseudo register.

When adding the "@$teb" pseudo register:

dt ntdll!_TEB @$teb ThreadLocalStoragePointer

+0x02c ThreatLocalStoragePointer : (null)

Without adding the "@$teb" pseudo register:

dt ntdll!_TEB ThreadLocalStoragePointer

+0x02c ThreatLocalStoragePointer : Ptr32 Void

windbg debugging
1 Answers

if you specify a pseudo register it will be evaluated to an address the output will display the result of evaluation

it is like specifying an address like dt ntdll!_teb 12345678`9abcdef0

if you do not provide an evaluable expression dt will simply print the structure

example

0:001> dt ntdll!_TEB ProcessEnvironmentBlock->ProcessParameters->CommandLine @$teb
   +0x060 ProcessEnvironmentBlock                                 :
      +0x020 ProcessParameters                                       :
         +0x070 CommandLine               : _UNICODE_STRING "dbstk.exe"
0:001> dt ntdll!_TEB ProcessEnvironmentBlock->ProcessParameters->CommandLine
   +0x060 ProcessEnvironmentBlock                                 :
      +0x020 ProcessParameters                                       :
         +0x070 CommandLine               : _UNICODE_STRING
0:001>

to address comment

yes it is like casting (TEB *) 0x12345678`9abcdef

you can also use c++ expression evaluator like below on all builtin PseudoRegisters or use an address

0:001> ?? @$teb->ProcessEnvironmentBlock->ProcessParameters->CommandLine
struct _UNICODE_STRING
 "dbstk.exe"
   +0x000 Length           : 0x12
   +0x002 MaximumLength    : 0x14
   +0x008 Buffer           : 0x000002a6`27290fb0  "dbstk.exe"
0:001> ? @$teb
Evaluate expression: 1080494329856 = 000000fb`927b1000
0:001> dt ntdll!_TEB ProcessEnvironmentBlock->ProcessParameters->CommandLine 000000fb`927b1000
   +0x060 ProcessEnvironmentBlock                                 :
      +0x020 ProcessParameters                                       :
         +0x070 CommandLine                                             : _UNICODE_STRING "dbstk.exe"
0:001>
user_36228130
Related