tags:

views:

552

answers:

1

Hi I did a uf command in windbg after attaching notepad.exe Command was uf notepad!WinMain i got the following output

0:000> uf notepad!WinMain
notepad!WinMain:
0021138d mov     edi,edi
0021138f push    ebp
00211390 mov     ebp,esp
00211392 sub     esp,1Ch
00211395 push    esi
00211396 push    edi
00211397 push    6
002113c8 test    eax,eax
002113ca jl      notepad!WinMain+0x118 (00211c93)

notepad!WinMain+0x43:
002113d0 push    ebx
002113d1 push    dword ptr [ebp+14h]
002113d4 push    edi
002113d5 call    notepad!SkipProgramName (00213170)
002113e5 je      notepad!WinMain+0x10e (00211ca9)

notepad!WinMain+0x5e:
002113eb push    esi
002113ec push    esi
002113ed call    dword ptr [notepad!_imp__GetCurrentProcessId (00211084)]

and so on.. If you notice after every jump instruction it creates a new block like

002113ca jl      notepad!WinMain+0x118 (00211c93)

notepad!WinMain+0x43:

and at

002113e5 je      notepad!WinMain+0x10e (00211ca9)

notepad!WinMain+0x5e:

So what i wanted to know a setting in WinDbg where i can omit the creation of the new block on every jump for a function disassembly. Why can't i get the output the way i get it with U command?

So i am looking for an option like this

002113c8 test    eax,eax002113ca 
jl      notepad!WinMain+0x118 (00211c93)
**blank line omitted**
**notepad!WinMain+0x43:** omitted**
002113d0 push    ebx002113d1 push    dword ptr [ebp+14h]

Any help?

+1  A: