It depends on what you mean by the return value. If you just want the raw
value look in the appropriate register when the routine returns. For
example, on x86 you would look at eax (or edx:eax for 64-bit quantities)
after the ret to see what the raw return value was. The debugger has
$retreg and $retreg64 pseudo-registers which abstract which specific
register so you can use them across all platforms. Note that certain
complex return values, like large by-value structure returns, may have more
complex conventions, such as implicitly being converted to by-reference
calls.
Finally, if you want the debugger to try and do some type-based formatting
you can use the .fnret command.
.fnret <funcaddr> [<retval>]
This command causes the debugger to look up the given function by address
and format the given return value (defaults to $retreg) according to the
type of the function return.
Post by Hua-Ying LingHi,
How would I get the return value of a OS function if I don't have access to
the source. I have the symbols for the OS loaded. I am doing kernel level
debugging.
Thanks
Hua-Ying