Displays current information about the stack and system calls on the stack.
vs [count]
count
By default, the number of words in the display depends on the number of parameters for the system call at the CS:EIP. When CS:EIP is not pointing to a system call, the entire contents of the stack display.
If the stack does not contain a system call, the display is either the number of stack elements you specify or all the stack contents, whichever is least. If a parameter is a string, the string is displayed.
The current SS:ESP registers are used to display the current stack values. The current CS:EIP is used for system call and parameter information. To change the CS:EIP value, use the monitor's g or x command.
If the current instruction is not a CALL instruction, the contents of the stack are displayed without a message. If the instruction is a CALL but not a system call, the stack contents are displayed with a message that the call is not a system call.
The gate number is displayed if the call is a C Library call.
This is the display format for system call information:
gate #NNNN xxxx:xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxx:xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxx:xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx (subsystem) system call |parameters|
The fields in the display are:
gate #NNNN
xxxx:xxxxxxxx
xxxxxxxx
(subsystem)
system call
Parameters
The following stack information displays:
gate #0158 1df3:00409fdc 000000c8 00401230 00001000 00000000 00409ffc 00401036 1df3:00409ff4 00000001 00404004 00000fe4 00000000 00000000 00000000 (INtime) CreateRtThread |..Priority..|..Entry..|..StackSz..|..Param..|
In this display, the CALL instruction has a stack address 1908:000007ca
. The parameter names identify the stack values directly above them. That is, the excep$p parameter name signifies that the first two words represent a pointer (1980:00000b08
) to the exception code. Similarly, the mbox
parameter signifies that the third word (1ea8
) is the handle for the mailbox being deleted.
This display is for a 32-bit application:
1df3:00409fe8 00403034 00409ffc 00401036 00000001 00404004 00000fe4 Not a system CALL
This display is stack information for CreateRtThread in a 32-bit application:
gate #0158 1df3:00409fdc 000000c8 00401230 00001000 00000000 00409ffc 00401036 1df3:00409ff4 00000001 00404004 00000fe4 00000000 00000000 00000000 (INtime) CreateRtThread |..Priority..|..Entry..|..StackSz..|..Param..|
This display indicates that the CALL instruction is CreateRtThread with 4 parameters. The names of these parameters are shown between the vertical bars (|). The words on the stack correspond to the parameters directly below them.
Syntax Error
Not a system CALL