User stack on 64-bit - Sysinternals Forums

Hello,
When getting the stack of an event on 64-bit, I get only one method in the user part of the stack:

0     fltMgr.sys     fltMgr.sys + 0x2ef2     0xf89afef2     C:\WINDOWS\System32\Drivers\fltMgr.sys
1     fltMgr.sys     fltMgr.sys + 0x6190     0xf89b3190     C:\WINDOWS\System32\Drivers\fltMgr.sys
2     fltMgr.sys     fltMgr.sys + 0x22dfe     0xf89cfdfe     C:\WINDOWS\System32\Drivers\fltMgr.sys
3     ntoskrnl.exe     ntoskrnl.exe + 0x2ba3dc     0x12ba3dc     C:\WINDOWS\system32\ntoskrnl.exe
4     ntoskrnl.exe     ntoskrnl.exe + 0x2b345e     0x12b345e     C:\WINDOWS\system32\ntoskrnl.exe
5     ntoskrnl.exe     ntoskrnl.exe + 0x2b983a     0x12b983a     C:\WINDOWS\system32\ntoskrnl.exe
6     ntoskrnl.exe     ntoskrnl.exe + 0x2c13c9     0x12c13c9     C:\WINDOWS\system32\ntoskrnl.exe
7     ntoskrnl.exe     ntoskrnl.exe + 0x2c1577     0x12c1577     C:\WINDOWS\system32\ntoskrnl.exe
8     ntoskrnl.exe     ntoskrnl.exe + 0x2c1639     0x12c1639     C:\WINDOWS\system32\ntoskrnl.exe
9     ntoskrnl.exe     ntoskrnl.exe + 0x41422     0x1041422     C:\WINDOWS\system32\ntoskrnl.exe
10     ntdll.dll     ntdll.dll + 0x3159a     0x78ef159a     C:\WINDOWS\system32\ntdll.dll

While on Windows 32-bit, I get this:
0     <unknown>     0xf97c9944     0xf97c9944
1     <unknown>     0xf97cb352     0xf97cb352
2     <unknown>     0xf97d7ccb     0xf97d7ccb
3     <unknown>     0xf97d8142     0xf97d8142
4     <unknown>     0x804eddf9     0x804eddf9
5     <unknown>     0x805b365e     0x805b365e
6     <unknown>     0x805afb3f     0x805afb3f
7     <unknown>     0x8056a133     0x8056a133
8     <unknown>     0x8056aaaa     0x8056aaaa
9     <unknown>     0x8056e291     0x8056e291
10     <unknown>     0x8053c808     0x8053c808
11     cmd.exe     cmd.exe + 0x10f1b     0x4ad10f1b     C:\WINDOWS\system32\cmd.exe
12     cmd.exe     cmd.exe + 0x10cb8     0x4ad10cb8     C:\WINDOWS\system32\cmd.exe
13     cmd.exe     cmd.exe + 0xd367     0x4ad0d367     C:\WINDOWS\system32\cmd.exe
14     cmd.exe     cmd.exe + 0xd2c1     0x4ad0d2c1     C:\WINDOWS\system32\cmd.exe
15     cmd.exe     cmd.exe + 0xd143     0x4ad0d143     C:\WINDOWS\system32\cmd.exe
16     cmd.exe     cmd.exe + 0x5aa2     0x4ad05aa2     C:\WINDOWS\system32\cmd.exe
17     cmd.exe     cmd.exe + 0x13eb     0x4ad013eb     C:\WINDOWS\system32\cmd.exe
18     cmd.exe     cmd.exe + 0xbbba     0x4ad0bbba     C:\WINDOWS\system32\cmd.exe
19     cmd.exe     cmd.exe + 0x5164     0x4ad05164     C:\WINDOWS\system32\cmd.exe
20     kernel32.dll     kernel32.dll + 0x16d4f     0x7c816d4f     C:\WINDOWS\system32\kernel32.dll

Does anyone have an idea about this?
thx

Author	Message Share Topic Printable Version Delicious Digg Facebook Furl Google MySpace Newsvine reddit StumbleUpon Translate Twitter Windows Live Yahoo Bookmarks Topic Search Topic Options Post Reply Create New Topic
Bryce Members Profile Send Private Message Find Members Posts Visit Members Homepage Add to Buddy List Senior Member Joined: 06 June 2005 Online Status: Offline Posts: 196	Post Options Post Reply Quote Bryce Report Post Quote Reply Topic: User stack on 64-bit Posted: 18 March 2008 at 2:13pm
	Support for this needs to come from the Windows platform. Try again with Vista SP1.

bowlosoup Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 01 August 2007 Online Status: Offline Posts: 2	Post Options Post Reply Quote bowlosoup Report Post Quote Reply Posted: 14 March 2008 at 11:30am
	Was there ever a solution to this? I have the same problem, and don't know if it's just a known limitation. I'm running a 64-bit app on Windows Server 2003 x64 using the dbghelp.dll from the 64-bit windbg debugger. The 32-bit equivalent setup has no issues. Thanks.

Bobie Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 17 October 2005 Online Status: Offline Posts: 20	Post Options Post Reply Quote Bobie Report Post Quote Reply Posted: 07 January 2008 at 10:03am
	Hello, When getting the stack of an event on 64-bit, I get only one method in the user part of the stack: 0 fltMgr.sys fltMgr.sys + 0x2ef2 0xf89afef2 C:\WINDOWS\System32\Drivers\fltMgr.sys 1 fltMgr.sys fltMgr.sys + 0x6190 0xf89b3190 C:\WINDOWS\System32\Drivers\fltMgr.sys 2 fltMgr.sys fltMgr.sys + 0x22dfe 0xf89cfdfe C:\WINDOWS\System32\Drivers\fltMgr.sys 3 ntoskrnl.exe ntoskrnl.exe + 0x2ba3dc 0x12ba3dc C:\WINDOWS\system32\ntoskrnl.exe 4 ntoskrnl.exe ntoskrnl.exe + 0x2b345e 0x12b345e C:\WINDOWS\system32\ntoskrnl.exe 5 ntoskrnl.exe ntoskrnl.exe + 0x2b983a 0x12b983a C:\WINDOWS\system32\ntoskrnl.exe 6 ntoskrnl.exe ntoskrnl.exe + 0x2c13c9 0x12c13c9 C:\WINDOWS\system32\ntoskrnl.exe 7 ntoskrnl.exe ntoskrnl.exe + 0x2c1577 0x12c1577 C:\WINDOWS\system32\ntoskrnl.exe 8 ntoskrnl.exe ntoskrnl.exe + 0x2c1639 0x12c1639 C:\WINDOWS\system32\ntoskrnl.exe 9 ntoskrnl.exe ntoskrnl.exe + 0x41422 0x1041422 C:\WINDOWS\system32\ntoskrnl.exe 10 ntdll.dll ntdll.dll + 0x3159a 0x78ef159a C:\WINDOWS\system32\ntdll.dll While on Windows 32-bit, I get this: 0 <unknown> 0xf97c9944 0xf97c9944 1 <unknown> 0xf97cb352 0xf97cb352 2 <unknown> 0xf97d7ccb 0xf97d7ccb 3 <unknown> 0xf97d8142 0xf97d8142 4 <unknown> 0x804eddf9 0x804eddf9 5 <unknown> 0x805b365e 0x805b365e 6 <unknown> 0x805afb3f 0x805afb3f 7 <unknown> 0x8056a133 0x8056a133 8 <unknown> 0x8056aaaa 0x8056aaaa 9 <unknown> 0x8056e291 0x8056e291 10 <unknown> 0x8053c808 0x8053c808 11 cmd.exe cmd.exe + 0x10f1b 0x4ad10f1b C:\WINDOWS\system32\cmd.exe 12 cmd.exe cmd.exe + 0x10cb8 0x4ad10cb8 C:\WINDOWS\system32\cmd.exe 13 cmd.exe cmd.exe + 0xd367 0x4ad0d367 C:\WINDOWS\system32\cmd.exe 14 cmd.exe cmd.exe + 0xd2c1 0x4ad0d2c1 C:\WINDOWS\system32\cmd.exe 15 cmd.exe cmd.exe + 0xd143 0x4ad0d143 C:\WINDOWS\system32\cmd.exe 16 cmd.exe cmd.exe + 0x5aa2 0x4ad05aa2 C:\WINDOWS\system32\cmd.exe 17 cmd.exe cmd.exe + 0x13eb 0x4ad013eb C:\WINDOWS\system32\cmd.exe 18 cmd.exe cmd.exe + 0xbbba 0x4ad0bbba C:\WINDOWS\system32\cmd.exe 19 cmd.exe cmd.exe + 0x5164 0x4ad05164 C:\WINDOWS\system32\cmd.exe 20 kernel32.dll kernel32.dll + 0x16d4f 0x7c816d4f C:\WINDOWS\system32\kernel32.dll Does anyone have an idea about this? thx