Using Instruction Pointer From CLR Events RRS feed

  • Question

  • I am in the research phase of getting the exception events using CLR ETW events.

    My consumer is written in C++ ( i.e . The trace will be enabled from C++ code and the Callback function will be in C++)

    From the link above, the details for the exception event is listed. In that , it gives a "win:Pointer" datatype and it gives the "Instruction pointer where exception occurred." .

    So From the above pointer , how can i get the detail from where the exception occurred. How to use that Instruction Pointer..? I dint find any documented usage for this. 

    Friday, March 3, 2017 5:52 AM

All replies

  • If the instruction pointer is in native code, then you could use a combination of VirtualQueryEx and GetModuleBaseName to get the module and the offset within it. I expect you could then use the dbghelp api to convert that into something more specific.

    If the instruction pointer is in managed code (in another process), then you would need to use the ICorDebug api to convert the address into a method + offset. I would like to think that this api provides a convenient way to get from native instruction pointer to ICorDebugFunction, but off the top of my head, I only know how to go in the other direction. (this could still work, but would be very inefficient). Of course, if you are going to use ICorDebug, then you might as well use it's exception notification mechanism.

    Saturday, March 4, 2017 10:18 AM