Hi all,

Not to minimize what Doug wrote:  :)

...
> Not to minimize the value of SHOT, and for those not fortunate enough to
> have such tools at their disposal, a quick stack trace of PIN 11 gives a
> pretty good indication of what it is:
>
> :debug
> DEBUG/iX C.05.08
>
> HPDEBUG Intrinsic at: a.00a2f698 hxdebug+$e4
> $1 ($64) nmdebug > pin #11
> $2 ($b) nmdebug > tr,i,d
...

There's more info on the above in my 1993 paper:
   http://www.allegro.com/papers/whorun.html

It's important to combine the "PIN" and "TR" command into one line:

    nmdebug>  PIN #11; tr,i,d

Why?  Because "PIN" takes a snapshot of the registers of the process.
The process may be executing ... if so, that snapshot gets older and
older ... to the point where the "TR" command may get grossly incorrect
data.  Combining the two onto one line minimizes the timing window (but
it doesn't eliminate it).

(P.s.: don't forget that "#" ... it means "decimal".  Otherwise,
you're likely to be getting a trace of process #9 or process #17
instead of #11.)

BTW, I wrote the paper after writing an even earlier article for
the HP Chronicle because I was tired of only having SHOT know
how to do this... I wanted to encourage GLANCE, SOS, etc., to add
the capability to get better process "name" information.

--
Stan Sieler                                          [log in to unmask]
                                         http://www.allegro.com/sieler/