在 WinDbg 中的断点上跟踪和监视 (wt)答案

【问题标题】：Trace and Watch (wt) on breakpoint in WinDbg在 WinDbg 中的断点上跟踪和监视 (wt)
【发布时间】：2019-04-10 02:31:53
【问题描述】：

我想获取 comctl32.dll 中的函数调用跟踪，从在树控件项上按下鼠标左键并按住鼠标按钮开始。

我可以在comctl32!TV_ButtonDown 上设置一个断点，然后在遇到断点时使用wt，但这需要我释放鼠标按钮并与WinDbg 交互。当我尝试为我的断点使用命令字符串时：bp comctl32!TV_ButtonDown "wt -m comctl32"，跟踪在到达断点后立即停止：

Tracing COMCTL32!TV_ButtonDown to return address 00007ffd`57a48f1d

0 instructions were executed in 0 events (0 from other threads)

Function Name                               Invocations MinInst MaxInst AvgInst

0 system calls were executed

COMCTL32!TV_ButtonDown+0x5:
00007ffd`57b03bd9 48896c2418      mov     qword ptr [rsp+18h],rbp ss:000000b7`746f8b00=0000000000000201

我正在尝试的可能吗？有其他选择吗？

【问题讨论】：

@ThomasWeller TV_ButtonDown 调用 TV_CheckForDragBegin 来泵送消息。当我必须与 windbg 交互时，我不想排队的 WM_LBUTTONUP。
@ThomasWeller，我需要在此期间和之后观察消息处理，其他发布的消息和 wm_timers 可能正在处理。

标签： windbg

【解决方案1】：

不是 64 位，而是 32 位提供结束地址（堆栈顶部或返回地址是我给 @$ra 的，不要释放鼠标
提供@$ra 不是强制性的，但您应该确保您将到达结束地址
最终没有释放鼠标 lsft 按钮）

0:000> bl
     0 e Disable Clear  6e57a2ee     0001 (0001)  0:**** COMCTL32!TV_ButtonDown "wt -m comctl32 @$ra"
0:000> g
   17     0 [  0] COMCTL32!TV_ButtonDown
   10     0 [  1]   COMCTL32!GetMessagePosClient
    3     0 [  2]     USER32!GetMessagePos
   18     3 [  1]   COMCTL32!GetMessagePosClient
   17     0 [  2]     USER32!ScreenToClient
   25    20 [  1]   COMCTL32!GetMessagePosClient
   20    45 [  0] COMCTL32!TV_ButtonDown
   22     0 [  1]   COMCTL32!TV_DismissEdit
   14     0 [  2]     USER32!IsWindowVisible
   26    14 [  1]   COMCTL32!TV_DismissEdit
   10     0 [  2]     USER32!GetDlgCtrlID
   33    24 [  1]   COMCTL32!TV_DismissEdit
   10     0 [  2]     USER32!SetWindowLongW
   48    34 [  1]   COMCTL32!TV_DismissEdit
   16     0 [  2]     COMCTL32!TV_InvalidateItem
   40     0 [  3]       COMCTL32!TV_GetItemRect
   24    40 [  2]     COMCTL32!TV_InvalidateItem
    4     0 [  3]       USER32!NtUserRedrawWindow
   27    44 [  2]     COMCTL32!TV_InvalidateItem
   52   105 [  1]   COMCTL32!TV_DismissEdit
    4     0 [  2]     USER32!NtUserShowWindow
   58   109 [  1]   COMCTL32!TV_DismissEdit
   34     0 [  2]     COMCTL32!CCSendNotify
   25     0 [  3]       USER32!GetParent
   40    25 [  2]     COMCTL32!CCSendNotify
   18     0 [  3]       USER32!GetWindow
   44    43 [  2]     COMCTL32!CCSendNotify
   10     0 [  3]       USER32!GetDlgCtrlID
   57    53 [  2]     COMCTL32!CCSendNotify
   24     0 [  3]       USER32!GetWindowThreadProcessId
   60    77 [  2]     COMCTL32!CCSendNotify
    1     0 [  3]       kernel32!GetCurrentProcessIdStub
    1     0 [  3]       kernel32!GetCurrentProcessId
    3     0 [  3]       KERNELBASE!GetCurrentProcessId
   87    82 [  2]     COMCTL32!CCSendNotify
   24     0 [  3]       USER32!SendMessageW
  109   106 [  2]     COMCTL32!CCSendNotify
   16     0 [  3]       COMCTL32!InOutAtoW
  118   122 [  2]     COMCTL32!CCSendNotify
    3     0 [  3]       COMCTL32!__security_check_cookie
  120   125 [  2]     COMCTL32!CCSendNotify
   67   354 [  1]   COMCTL32!TV_DismissEdit
    4     0 [  2]     USER32!NtUserDestroyWindow
   75   358 [  1]   COMCTL32!TV_DismissEdit
    3     0 [  2]     COMCTL32!__security_check_cookie
   77   361 [  1]   COMCTL32!TV_DismissEdit
   27   483 [  0] COMCTL32!TV_ButtonDown
    3     0 [  1]   COMCTL32!__security_check_cookie
   29   486 [  0] COMCTL32!TV_ButtonDown

515 instructions were executed in 514 events (0 from other threads)

Function Name                               Invocations MinInst MaxInst AvgInst
COMCTL32!CCSendNotify                                 1     120     120     120
COMCTL32!GetMessagePosClient                          1      25      25      25
COMCTL32!InOutAtoW                                    1      16      16      16
COMCTL32!TV_ButtonDown                                1      29      29      29
COMCTL32!TV_DismissEdit                               1      77      77      77
COMCTL32!TV_GetItemRect                               1      40      40      40
COMCTL32!TV_InvalidateItem                            1      27      27      27
COMCTL32!__security_check_cookie                      3       3       3       3
KERNELBASE!GetCurrentProcessId                        1       3       3       3
USER32!GetDlgCtrlID                                   2      10      10      10
USER32!GetMessagePos                                  1       3       3       3
USER32!GetParent                                      1      25      25      25
USER32!GetWindow                                      1      18      18      18
USER32!GetWindowThreadProcessId                       1      24      24      24
USER32!IsWindowVisible                                1      14      14      14
USER32!NtUserDestroyWindow                            1       4       4       4
USER32!NtUserRedrawWindow                             1       4       4       4
USER32!NtUserShowWindow                               1       4       4       4
USER32!ScreenToClient                                 1      17      17      17
USER32!SendMessageW                                   1      24      24      24
USER32!SetWindowLongW                                 1      10      10      10
kernel32!GetCurrentProcessId                          1       1       1       1
kernel32!GetCurrentProcessIdStub                      1       1       1       1

0 system calls were executed

eax=00000000 ebx=00000201 ecx=422f0fd7 edx=77a370f4 esi=002d9590 edi=00000200
eip=6e542888 esp=0012fcc4 ebp=0012fd00 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
COMCTL32!TV_WndProc+0x577:
6e542888 e90a060000      jmp     COMCTL32!TV_WndProc+0x5de (6e542e97)

【讨论】：

看起来我最初的问题实际上是由 WinDbg Preview 引起的。对不起，我没有提到我正在使用它。我使用了普通的 WinDbg，它可以工作（有点）。
不幸的是它在跟踪一点后仍然停止我在这里停止：警告：此中断不是步骤/跟踪完成。已清除最后一条命令以防止此无关事件意外继续。在恢复之前检查事件、位置和线程。 (16c.3f6c)：单步异常 - 代码 80000004（第一次机会）在任何异常处理之前报告第一次机会异常。可以预期并处理此异常。 ntdll!KiUserCallbackDispatch