windbg - Getting exit code of a terminated process -
i'm debugging process in windbg, , process exited:
0:009> g (bunch of regs...) ntdll!ntterminateprocess+0xc: 770ad43c c20800 ret 8 0:009> g ^ no runnable debuggees error in 'g'
at point, how process' exit code?
you find second argument of zwterminateprocess. ntterminateprocess kernel version of it, right?
0:000> kb childebp retaddr args child 003ff414 7774d5ac ffffffff 1234abcd 00000000 ntdll!zwterminateprocess+0x12 003ff430 759c79ec 00000000 77e8f3b0 ffffffff ntdll!rtlexituserprocess+0x85 ...
or fourth parameter of rtlexituserprocess
0:000> kn # childebp retaddr 00 003ff414 7774d5ac ntdll!zwterminateprocess+0x12 01 003ff430 759c79ec ntdll!rtlexituserprocess+0x85 ... 0:000> .frame 01 01 003ff430 759c79ec ntdll!rtlexituserprocess+0x85 0:000> dd esp l4 003ff414 7771fcc2 7774d5ac ffffffff 1234abcd
Comments
Post a Comment