windbg - Getting exit code of a terminated process -


i'm debugging process in windbg, , process exited:

0:009> g (bunch of regs...) ntdll!ntterminateprocess+0xc: 770ad43c c20800          ret     8 0:009> g        ^ no runnable debuggees error in 'g' 

at point, how process' exit code?

you find second argument of zwterminateprocess. ntterminateprocess kernel version of it, right?

0:000> kb childebp retaddr  args child               003ff414 7774d5ac ffffffff 1234abcd 00000000 ntdll!zwterminateprocess+0x12 003ff430 759c79ec 00000000 77e8f3b0 ffffffff ntdll!rtlexituserprocess+0x85 ... 

or fourth parameter of rtlexituserprocess

0:000> kn  # childebp retaddr   00 003ff414 7774d5ac ntdll!zwterminateprocess+0x12 01 003ff430 759c79ec ntdll!rtlexituserprocess+0x85 ...  0:000> .frame 01 01 003ff430 759c79ec ntdll!rtlexituserprocess+0x85  0:000> dd esp l4 003ff414  7771fcc2 7774d5ac ffffffff 1234abcd 

Comments

Popular posts from this blog

php - Submit Form Data without Reloading page -

linux - Rails running on virtual machine in Windows -

php - $params->set Array between square bracket -