x (Examine Symbols)
The x command displays the symbols in all contexts that match the specified pattern.
x [Options] Module!Symbol
x [Options] *
Parameters
Options Specifies symbol searching options. You can use one or more of the following options:
/0
Displays only the address of each symbol.
/1
Displays only the name of each symbol.
/2
Displays only the address and name of each symbol (not the data type).
/D
Displays the output using Debugger Markup Language.
/t
Displays the data type of each symbol, if the data type is known.
/v
Displays the symbol type (local, global, parameter, function, or unknown) of each symbol. This option also displays the size of each symbol. The size of a function symbol is the size of the function in memory. The size of other symbols is the size of the data type that the symbol represents. Size is always measured in bytes and displayed in hexadecimal format.
/s Size
Display only those symbols whose size, in bytes, equals the value of Size. The Size of a function symbol is the size of the function in memory. The Size of other symbols is the size of the data type that the symbol represents. Symbols whose size cannot be determined are always displayed. Size must be a nonzero integer.
/q
Displays symbol names in quoted format.
/p
Omits the space before the opening parenthesis when the debugger displays a function name and its arguments. This kind of display can make it easier if you are copying function names and arguments from the x display to another location.
/f
Displays the data size of a function.
/d
Displays the data size of data.
/a
Sorts the display by address, in ascending order.
/A
Sorts the display by address, in descending order.
/n
Sorts the display by name, in ascending order.
/N
Sorts the display by name, in descending order.
/z
Sorts the display by size, in ascending order.
/Z
Sorts the display by size, in descending order.
Module
Specifies the module to search. This module can be an .exe, .dll, or .sys file. Module can contain a variety of wildcard characters and specifiers. For more information about the syntax, see String Wildcard Syntax.
Symbol
Specifies a pattern that the symbol must contain. Symbol can contain a variety of wildcard characters and specifiers. For more information about the syntax, see String Wildcard Syntax.
Because this pattern is matched to a symbol, the match is not case sensitive, and a single leading underscore (_) represents any quantity of leading underscores. You can add spaces within Symbol, so that you can specify symbol names that contain spaces (such as "operator new" or "Template<A, B>") without using wildcard characters.
Environment
| Item | Description |
|---|---|
| Modes | User mode, kernel mode |
| Targets | Live, crash dump |
| Platforms | All |
Remarks
The following command finds all of the symbols in MyModule that contain the string "spin".
0:000> x mymodule!*spin*
The following command quickly locates the "DownloadMinor" and "DownloadMajor" symbols in MyModule.
0:000> x mymodule!downloadm??or
You can also show all symbols in the MyModule by using the following command.
0:000> x mymodule!*
The preceding commands also force the debugger to reload symbol information from MyModule. If you want to reload the symbols in the module with a minimal display, use the following command.
0:000> x mymodule!*start*
A few symbols always contain the string "start". Therefore, the preceding command always displays some output to verify that the command works. But the preceding command avoids the excessive display length of x mymodule!*.
The display shows the starting address of each symbol and the full symbol name. If the symbol is a function name, the display also includes a list of its argument types. If the symbol is a global variable, its current value is displayed.
There is one other special case of the x command. To display the addresses and names of all local variables for the current context, use the following command.
0:000> x *
Note In most cases, you cannot access local variables unless private symbols have been loaded. For more information about this situation, see dbgerr005: Private Symbols Required. To display the values of local variables, use the dv (Display Local Variables) command.
The following example illustrates the /0, /1, and /2 options.
0:000:x86> x /0 MyApp!Add*
00b51410
00b513d0
0:000:x86> x /1 MyApp!Add*
MyApp!AddThreeIntegers
MyApp!AddTwoIntegers
0:000:x86> x /2 MyApp!Add*
00b51410 MyApp!AddThreeIntegers
00b513d0 MyApp!AddTwoIntegers
The /0, /1, and /2 options are useful if you want to use the output of the x command as input to the .foreach command.
.foreach ( place { x /0 MyApp!*MySym*} ) { .echo ${place}+0x18 }
The following example demonstrates the switch /f when used to filter functions on the module notepad.exe.
0:000> x /f /v notepad!*main*
prv func 00000001`00003340 249 notepad!WinMain (struct HINSTANCE__ *, struct HINSTANCE__ *, char *, int)
prv func 00000001`0000a7b0 1c notepad!WinMainCRTStartup$filt$0 (void)
prv func 00000001`0000a540 268 notepad!WinMainCRTStartup (void)
When you use the /v option, the first column of the display shows the symbol type (local, global, parameter, function, or unknown). The second column is the address of the symbol. The third column is the size of the symbol, in bytes. The fourth column shows the module name and symbol name. In some cases, this display is followed by an equal sign (=) and then the data type of the symbol. The source of the symbol (public or full symbol information) is also displayed.
kd> x /v nt!CmType*
global 806c9e68 0 nt!CmTypeName = struct _UNICODE_STRING []
global 806c9e68 150 nt!CmTypeName = struct _UNICODE_STRING [42]
global 806c9e68 0 nt!CmTypeName = struct _UNICODE_STRING []
global 805bd7b0 0 nt!CmTypeString = unsigned short *[]
global 805bd7b0 a8 nt!CmTypeString = unsigned short *[42]
In the preceding example, the size is given in hexadecimal format, while the data type is given in decimal format. Therefore, in the last line of the preceding example, the data type is an array of 42 pointers to unsigned short integers. The size of this array is 42*4 = 168, and 168 is displayed in hexadecimal format as 0xA8.
You can use the /sSize option to display only those symbols whose size, in bytes, is a certain value. For example, you can restrict the command in the preceding example to symbols that represent objects whose size is 0xA8.
kd> x /v /s a8 nt!CmType*
global 805bd7b0 a8 nt!CmTypeString = unsigned short *[42]
Working With Data Types
The /t option causes the debugger to display information about each symbol's data type. Note that for many symbols, this information is displayed even without the /t option. When you use /t, such symbols have their data type information displayed twice.
0:001> x prymes!__n*
00427d84 myModule!__nullstring = 0x00425de8 "(null)"
0042a3c0 myModule!_nstream = 512
Type information missing error for _nh_malloc
004021c1 myModule!MyStructInstance = struct MyStruct
00427d14 myModule!_NLG_Destination = <no type information>
0:001> x /t prymes!__n*
00427d84 char * myModule!__nullstring = 0x00425de8 "(null)"
0042a3c0 int myModule!_nstream = 512
Type information missing error for _nh_malloc
004021c1 struct MyStruct myModule!MyStructInstance = struct MyStruct
00427d14 <NoType> myModule!_NLG_Destination = <no type information>
The x command will display an instance of a type.
0:001> x foo!MyClassInstance
00f4f354 foo!MyClassInstance = 0x00f78768
The x command does not display anything based on just the name of a type.
0:001> x foo!MyClass
0:001>
To display type information using the name of a type, consider using dt (Display Type), it provides information for both types and instances of types:
0:001> dt foo!MyClass
+0x000 IntMemberVariable : Int4B
+0x004 FloatMemberVariable : Float
+0x008 BoolMemberVariable : Bool
+0x00c PtrMemberVariable : Ptr32 MyClass
Working With Templates
You can use wild cards with the x command to display template classes as shown in this sample.
0:001> x Fabric!Common::ConfigEntry*TimeSpan?
000007f6`466a2f9c Fabric!Common::ConfigEntry<Common::TimeSpan>::ConfigEntry<Common::TimeSpan> (void)
000007f6`466a3020 Fabric!Common::ConfigEntry<Common::TimeSpan>::~ConfigEntry<Common::TimeSpan> (void)
Consider using the dt (Display Type) command when working with templates, as the x command does not display individual template class items.
0:001> dt foo!Common::ConfigEntry<Common::TimeSpan>
+0x000 __VFN_table : Ptr64
+0x008 componentConfig_ : Ptr64 Common::ComponentConfig
+0x010 section_ : std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >
+0x038 key_ : std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >