Menu
I am trying to debug some win32API's like Createthread which returns a handle. How to get the return values in windbg?
I did some research and found that return values generally stored in EAx register.
If I put breakpoint on CreateThread then I can step into assembly of Createthread and ultimatelyw I will hit ret statement which means Createthread is returning .
At this point should I check the value of EAX register to get the HANDLE value or is the some other way?
574
To return a value from a function, you must include a return statement, followed by the value to be returned, before the function's end statement. If you do not include a return statement or if you do not specify a value after the keyword return, the value returned by the function is unpredictable.
A function defined with a return type must include an expression containing the value to be returned. In this example, the return statement initializes a variable of the returned type. The variable answer is initialized with the int value 30. The type of the returned expression is checked against the returned type.
A return statement ends the execution of a function, and returns control to the calling function. Execution resumes in the calling function at the point immediately following the call. A return statement can return a value to the calling function.
A return statement, once executed, immediately terminates execution of a function, even if it is not the last statement in the function. In the following code, when line 3 executes, the value 5 is returned and assigned to the variable x, then printed.
There isn't another way that isn't basically the same as testing eax.
If you want to get pedantic:
eax works fine for 32 bit.
rax is what you'll want for 64 bit apps
ret0 is what itanium uses
$retreg is a pseudo register you can use that will behave properly in all cases.
e.g.
0:028> r rax rax=00000000fff02000 0:028> r eax eax=fff02000 0:028> r $retreg $retreg=00000000fff02000
159
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
