Geeks With Blogs
Kate Moss' Open Space

I have introduced a method to detect the stack size and other stack info during runtime in this article

But what if we want to determine the stack size on arbitrary thread or for whatever reason, writing a code is not an option but wish to peek the stack size via debugger?
Fortunately, there is a debugger extension (CeDebugX) provides many power tools, such as !stacktrace or !stackeval to get the stack info for specific thread.
For detail please refer to

Basically, you can roughly estimate the stack size by comparing the diff between last and first frame ptr from the output of !stacktrace.
For more accurate result, you can use !stackeval which shows you the stack low (current SP) and all of the contents in each frames.

Here is an example from the the output of CE7 to demostrate how parsing the stack size.
As this is a user thread and block in an API call, so we can see there are 2 stack, one for user mode, the other for kernel mode.
The current SP is 0xccfef9a8, so obviously, it is in kernel space which mean a Secure Stack.
The base of Secure Stack is 0xccfeff00, thus the use for secure stack part is 0xccfeff00 - 0xccfef968 = 0x598.
And for user mode stack, the base is 0x0002ff00, Stack low is 0x0002fae0, so 0x0002ff00 - 0x0002fae0 = 0x420.

Windows CE>!stackeval 0xC041D028
Stack Evaluate for thread 0xc041d028
 | pThread   : 0xc041d028
 | hThread   : 0x000000c8
  Stack ptr      : 0xccfef9a8
  Secure stack bound : 0xccfee000
  Secure stack base  : 0xccfeff00
  User stack bound  : 0x0002f000
  User stack base   : 0x0002ff00
  Stack frames:
   #  Frame Ptr  PC
  [ 0] 0xccfef9a8, 0x00005263
  [ 1] 0xccfef9b4, 0x000147bd
  [ 2] 0xccfef9d4, 0x0000abd3
  [ 3] 0xccfefa88, 0x00014c31
  [ 4] 0xccfefbf4, 0x00014e72
  [ 5] 0x0002fb20, 0x00013f67
  [ 6] 0x0002fb30, 0x0000067b
  [ 7] 0x0002fb3c, 0x00000619
  [ 8] 0x0002fb84, 0x000003d1
  [ 9] 0x0002fb9c, 0x0000041d
  [10] 0x0002fc18, 0x0002331e
  Secure stack low : 0xccfef968
  Stack low     : 0x0002fae0

Posted on Monday, September 5, 2011 4:17 PM | Back to top

Comments on this post: Use CE Debugger Extension (CeDebugX) to Find Stack Size

No comments posted yet.
Your comment:
 (will show your gravatar)

Copyright © Kate Moss' Open Space | Powered by: