TTD 線程物件
Description
TTD Thread 物件可用來提供線程及其在時間移動追蹤期間存留期的相關信息。
屬性
屬性 | Description |
---|---|
UniqueId | 整個追蹤線程的唯一標識碼。 |
識別碼 | 線程的 TID。 |
Children
Object | 描述 |
---|---|
一生 | 描述線程存留期的 TTD 範圍物件 。 |
ActiveTime | 描述線程作用中時間的 TTD範圍物件 。 |
使用方式範例
使用此 dx 命令來顯示陣列中的所有線程。
0:0:000> dx -g @$curprocess.TTD.Threads
=================================================================================================================
= = (+) UniqueId = (+) Id = (+) Lifetime = (+) ActiveTime =
=================================================================================================================
= [0x0] : UID: 2, TID: 0x2428 - 0x2 - 0x2428 - [0:0, 6F0C4:0] - [50C63:0, 6F0C4:0] =
= [0x1] : UID: 3, TID: 0x3520 - 0x3 - 0x3520 - [0:0, FFFFFFFFFFFFFFFE:0] - [5115A:0, 56B07:0] =
= [0x2] : UID: 4, TID: 0x18E8 - 0x4 - 0x18e8 - [0:0, FFFFFFFFFFFFFFFE:0] - [52F65:0, 56B1E:0] =
= [0x3] : UID: 5, TID: 0x5690 - 0x5 - 0x5690 - [0:0, FFFFFFFFFFFFFFFE:0] - [5300D:0, 5D4FA:0] =
= [0x4] : UID: 6, TID: 0x46FC - 0x6 - 0x46fc - [0:0, FFFFFFFFFFFFFFFE:0] - [53782:0, 5433B:0] =
= [0x5] : UID: 7, TID: 0x58D0 - 0x7 - 0x58d0 - [0:0, FFFFFFFFFFFFFFFE:0] - [542FE:0, 543B9:0] =
= [0x6] : UID: 8, TID: 0x950 - 0x8 - 0x950 - [0:0, FFFFFFFFFFFFFFFE:0] - [543C4:0, 544B8:0] =
= [0x7] : UID: 9, TID: 0x4514 - 0x9 - 0x4514 - [0:0, 6D61B:0] - [5DBBD:0, 6D61B:0] =
=================================================================================================================
使用此 dx 命令可顯示陣列中第一個線程的相關信息。
0:0:000 dx -r2 @$curprocess.TTD.Threads[0]
@$curprocess.TTD.Threads[0] : UID: 2, TID: 0x2428
UniqueId : 0x2
Id : 0x2428
Lifetime : [0:0, 6F0C4:0]
MinPosition : Min Position [Time Travel]
MaxPosition : 6F0C4:0 [Time Travel]
ActiveTime : [50C63:0, 6F0C4:0]
MinPosition : 50C63:0 [Time Travel]
MaxPosition : 6F0C4:0 [Time Travel]
[Time Travel] 連結提供在線程作用中時追蹤中特定貼文的 SeekTo () 連結。
0:0:000> dx @$curprocess.TTD.Threads[0].@"ActiveTime".@"MinPosition".SeekTo()
Setting position: 50C63:0
@$curprocess.TTD.Threads[0].@"ActiveTime".@"MinPosition".SeekTo()
(40b4.2428): Break instruction exception - code 80000003 (first/second chance not available)
Time Travel Position: 50C63:0
ntdll!NtTestAlert+0x14:
00007ffb`e3e289d4 c3 ret