Mark Gao's List: IT:resOS

• So first, a stack trace is specific to a thread
• The period in the left hand margin indicates the current thread that is “in context”
• The column following Id: is the actual process ID and thread ID in hexadecimal (pid.tid).
• I can either set my context to this thread, or view it by explicitly stating I want this thread when issuing the “k” command.   To set my context, I use ~36s.  The “s” says to take thread 36 (~36) and set our context (s).
• To just view the stack trace while still in the context of another thread, I state the thread and give the stack command like this: ~36k
• The Child-SP is the base pointer for a frame in a stack trace – basically where in memory this frame starts.
• The exclamation mark is used before extension commands that are contained in external DLL files and not part of the debugger. 
• This register is a multipurpose register and is commonly used to hold return values and the results of operations. 
• “rax”, we know this is 64 bit architecture.  On a 32 bit platform, it was called “eax”
• Each “digit” represents 4 bits or a “nibble”.
• it takes two digits here to represent a byte. 
• The “rip” is the current IP pointer – or the instruction pointer.  As it sounds, this is the next instruction to execute.  The “rsp” register contains a pointer to the current location on the stack. 
• You can use the symbol name or the memory address where the function starts.
• you can set breakpoints on memory access. 

12 more annotations...

• GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

• Interpreting the Cluster Log