Can I disable the “Unable to read dynamic function

2019-07-26 22:04发布

问题:

I'm working with a program that generates a lot of code at runtime, and seems not to produce any unwind data for it. (I don't have source code for this program; I'm writing a plugin for it.)

When the program hangs, I break into it with WinDbg, and try to get a stack trace for all threads with ~* k. As well as the stack traces, I also get pages and pages (and pages, and more) of messages along the line of

Unable to read dynamic function table entry at 00000000`2450b580

This takes a long time to print - over a minute - and it overflows the scroll buffer, so I lose most of the output.

I've worked around this for now by hex-editing the DLL that contains this message, but... seriously. Is there an official way of getting rid of this message?

I'm prepared for a crappy stack trace from the problem thread(s).

回答1:

Note that this is a security feature, so disable it at your own risk. There are two options:

  • If you know which module is causing this, you can add the full path to the register: HKLM\Software\Microsoft\Windows NT\CurrentVersion\KnownFunctionTableDlls registry key
  • You can disable it with .settings set EngineInitialization.VerifyFunctionTableCallbacks=false

The second option only disables it for the current session. If you want to make it permanent, you can follow it with .settings save.



回答2:

if you are running the latest versions of windbg

you can try setting the Engine Initialization Settings

0:000> dx Debugger.Settings.EngineInitialization.VerifyFunctionTableCallbacks
Debugger.Settings.EngineInitialization.VerifyFunctionTableCallbacks                 : true
0:000> dx Debugger.Settings.EngineInitialization.VerifyFunctionTableCallbacks = false
Debugger.Settings.EngineInitialization.VerifyFunctionTableCallbacks = false : false
0:000> dx Debugger.Settings.EngineInitialization.VerifyFunctionTableCallbacks
Debugger.Settings.EngineInitialization.VerifyFunctionTableCallbacks                 : false