tramsdell

Forum Replies Created

Viewing 1 post (of 1 total)
  • Author
    Posts
  • in reply to: is virtualkd being actively maintained? #1694
    tramsdell
    Participant

    [Some versions of] RtlAssert are not trapping into the debugger. It sounds like it’s a known problem: http://www.osronline.com/showThread.CFM?link=202105

    I ran into this on Server `08 R2, x64. Here’s what I see when poking around and it seems consistent with Scott’s reply. The byte read has a value of 1 but is expected to be 3 – so it skips over the prompt to break into the debugger.

    1: kd>
    nt!RtlAssert+0x6b:
    fffff800`0179917f 4c0f45cb cmovne r9,rbx
    fffff800`01799183 33d2 xor edx,edx
    fffff800`01799185 8d4a65 lea ecx,[rdx+65h]
    fffff800`01799188 e80b58ffff call nt!DbgPrintEx (fffff800`0178e998)
    fffff800`0179918d a0d402000080f7ffff mov al,byte ptr [FFFFF780000002D4h]
    fffff800`01799196 2403 and al,3
    fffff800`01799198 3c03 cmp al,3
    fffff800`0179919a 0f85f6000000 jne nt!RtlAssert+0x182 (fffff800`01799296)
    1: kd> db FFFFF780000002D4
    fffff780`000002d4 01 03 00 00 01 00 00 00-00 00 00 00 ff ff ff ff ................

    This is a pretty fantastic tool and I would be willing to contribute to it’s advancement. You can contact me privately if you like.

Viewing 1 post (of 1 total)