I set a breakpoint in kernel32!LoadLibraryExW. In the calls window, I have “Source args” toggled, but the call stack still doesn’t show the arguments for LoadLibraryExW when it breaks. Is there a way to easily view the arguments?
I have set the environment variable _NT_SYMBOL_PATH to SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
You can’t directly match the arguments to the function parameters with ‘Source Args’ toggled. These are available only with private PDBs.
You have to toggle ‘Raw args’ and make them fit with the documentation from MSDN.
If you need more than 3 arguments you must view the memory starting at esp.
This is quite simple with 32 bits, but it may be a pain with 64 bits because the arguments may not be actually written to the stack (they are passed by registers and copied to the stack only if the registers need to be overwritten and restored). For more information, you can refer to http://msdn.microsoft.com/en-us/library/ms235286(v=vs.80).aspx If you have control on the source code, compile with the /homeparams flag on the C compiler to be sure the parameters are copied on the stack to ease debugging.