The following list provides guidelines for intercepting traps and exceptions under the Kernel Debugger for various circumstances:

Fatal exceptions occurring in application ring 2/3 code.

BP _XCPTBuildR3DispatcherStack will trap every software and hardware exception. The breakpoint is in the kernel, so use .R to display the registers at the time of the exception. This break-point works regardless of whether exception handlers are registered.

Note: If the exception is generated through use of an API (bad parameter or DosRaiseException) then the CS:EIP will point after the call gate instruction.

Fatal Hardware Traps and Faults in application ring 2/3 code.
VSF * will intercept all such exceptions at the point of the exception.
Fatal Hardware Traps and Faults in ring 0 code.
VTF * will intercept all such exceptions at the point of the exception, providing no Local Fault Handler has been registered.
All ring 0-3 traps and faults.
VT * will intercept them all.
All application ring 2/3 code traps and faults.
VS * will intercept them all.
Exceptions in application ring 2/3 code that will drive exception handlers.
BP _xcptr3ExceptionDispatcher will be intercepted if any are registered, but this will be called once to process the entire chain.
Each User Exception Handler.
BP _xcptExecuteUserExceptionHandler will be called to dispatch each exception handler. Alternatively use the registration records from the TIB to locate the entry point of a given exception handler.
Post User Exception Handling
VSU will intercept and unrecovered fatal exception delivered to ring 2 and 3 after exception handler processing.

Note:

User exception handlers can be disabled under the Kernel Debugger by locating the TIB, then storing 0xffffffff at offset 0x0, which is the pointer to the exception registration record chain. The chain is terminated by 0xffffffff and can be re-worked manually for debugging purposes - provided that the system is not already processing an exception for this thread.

---

[Back] [Next]