Open vladimirklign opened 1 month ago
We have this today. Each thread in the process has a current position:
dx -g @$curprocess.Threads.Select(x => new { Id = x.Id, Position = x.TTD.Position })
======================================
= = Id = Position =
======================================
= [0x5324] - 0x5324 - E:0 =
= [0xd300] - 0xd300 - 3A9:0 =
======================================
If you mean the position of the thread the debugger is currently viewing you can use this:
Time Travel Position: E:0 [Unindexed] Index
ntdll!LdrInitializeThunk:
00007ff9`373c42a0 4053 push rbx
0:000> dx @$curthread.TTD.Position
@$curthread.TTD.Position : E:0
Sequence : 0xe
Steps : 0x0
SeekTo [Method which seeks to time position]
ToSystemTime [Method which obtains the approximate system time at a given position]
Feature request: There is no method (at least I did not find it) that allows to do something like that:
0:000> @$curpos = @$cursession.TTD.CurrentPosition 0:000> dx @$cursession.TTD.Memory(0x12345678, 0x12345680, "w").Where(x => (x.TimeStart > @$curpos) && (x.TimeEnd < @$anotherpos))
Thank you!