TTD Calls Objects


TTD Calls objects are used to give information about function calls that occur over the course of a trace.


Property Description
Function!SymbolName One or more contained in double quotes, separated by a comma. For example dx @$cursession.TTD.Calls("module!symbol1", "module!symbol2", ...)


Property Description
EventType The type of event. This is "Call" for all TTD Calls objects.
ThreadId The OS thread ID of thread that made the request.
UniqueThreadId A unique ID for the thread across the trace. Regular thread IDs can get reused over the lifetime of a process but UniqueThreadIds cannot.
Function The symbolic name of the function.
FunctionAddress The function's address in memory.
ReturnValue The return value of the function. If the function has a void type, this property will not be present.


Object Description
Parameters[] An array containing the parameters passed to the function. The number of elements varies based on the type signature of the function.
TimeStart A position object that describes the position at the start of the call.
TimeEnd A position object that describes the position at the end of the call.


Time travel debugging uses symbol information provided in the PDBs to determine the number of parameters for a function and their types, the return value type, and the calling convention. In the event that symbol information is not available or the symbols have been restricted to public symbol information, it is still possible to do queries. The time travel query engine will make some assumptions in this scenario:

  • There are four 64-bit unsigned integer parameters to the function
  • The return value is a 64-bit unsigned integer
  • The function name is set to a fixed string: “UnknownOrMissingSymbols”

These assumptions allow queries to be made in the absence of adequate symbol information. However, for best results use full PDB symbols when possible.

Note that the Calls function does computation, and depending on the size of the trace, it can take a while to run. CPU usage will spike during the computation and watching CPU usage in task manager, gives an indication that the computation is progressing. The query results are cached in memory so subsequent queries against previously queried calls are significantly faster.

Example Usage

This example shows the calls object for ucrtbase!initterm.

0:000> dx -r2 @$cursession.TTD.Calls("ucrtbase!initterm")
        EventType        : Call
        ThreadId         : 0x2074
        UniqueThreadId   : 0x2
        TimeStart        : 1E:5D0
        TimeEnd          : 2D:E
        Function         : ucrtbase!_initterm
        FunctionAddress  : 0x7ffb345825d0
        ReturnAddress    : 0x7ff6a521677e

See Also

Time Travel Debugging - Introduction to Time Travel Debugging objects

Time Travel Debugging - Overview