bits and bytes

windbg: kf command

Nibu Thomas — Tue, 10 Apr 2012 00:20:26 +0000

kf is a useful command to find out stack memory taken by a frame. See below…
I have three functions which looks like this…

#pragma auto_inline(off)
void TestStack2()
{
       printf("hello");
       return;
}
void TestStack1()
{
       TestStack2();
       char bytes[0x190] = {9};
       printf("hello: %s", bytes);
}
void TestStack()
{
       TestStack1();
       char bytes[0x90] = {9};
       printf("hello: %s", bytes);
}

// Check out the frame sizes…
Memory ChildEBP RetAddr
          0024f000 00291578 TestMFC1!TestStack2+0×5
      19c 0024f19c 002915d8 TestMFC1!TestStack1+0×18
       9c 0024f238 002916ea TestMFC1!TestStack+0×18
       28 0024f260 7856f282 TestMFC1!CTestMFC1Dlg::OnInitDialog+0xca
        8 0024f268 752c62fa mfc100!AfxDlgProc+0×31
       2c 0024f294 752ef9df USER32!InternalCallWinProc+0×23
       7c 0024f310 752ef784 USER32!UserCallDlgProcCheckWow+0xd7

Alternatively we can take difference of child ebp and current esp to know frame size.

How to force symbol loading in WinDbg

Nibu Thomas — Mon, 05 Mar 2012 23:33:46 +0000

Sometimes we could have a dump which does not load .pdb files even though they are present in the dump folder. The reason for the load failure is not necessarily every time a code change but could be just a rebuild of the source code. In such cases if you force load the .pdb file you should get a call stack that makes sense but you got to be good at API’s and libraries to make sure the stack makes sense. So until you get a proper .pdb file you can force load a .pdb file and work on the dump.
——————————————————-
Remember: Always insist on correct pdb file.
——————————————————-
So the command to enable this feature is: ‘.symopt’. Lists out the current symbol loading options. On my machine this is what I get…

0:000> .symopt
Symbol options are 0×30377:
0×00000001 – SYMOPT_CASE_INSENSITIVE
0×00000002 – SYMOPT_UNDNAME
0×00000004 – SYMOPT_DEFERRED_LOADS
0×00000010 – SYMOPT_LOAD_LINES
0×00000020 – SYMOPT_OMAP_FIND_NEAREST
0×00000100 – SYMOPT_NO_UNQUALIFIED_LOADS
0×00000200 – SYMOPT_FAIL_CRITICAL_ERRORS
0×00010000 – SYMOPT_AUTO_PUBLICS
0×00020000 – SYMOPT_NO_IMAGE_SEARCH

These flags determine how and what symbols will be loaded. These options also determine whether line number information should be loaded or not.

So in our debugging scenario if we want to load symbols in a loose manner, i.e., without strict mapping of .pdb with .exe we will have to enable the following option…

0×00000040 – SYMOPT_LOAD_ANYTHING

In windbg we do this via…

0:000> .symopt+ 0×40
Symbol options are 0×30377:
0×00000001 – SYMOPT_CASE_INSENSITIVE
0×00000002 – SYMOPT_UNDNAME
0×00000004 – SYMOPT_DEFERRED_LOADS
0×00000010 – SYMOPT_LOAD_LINES
0×00000020 – SYMOPT_OMAP_FIND_NEAREST
0×00000040 – SYMOPT_LOAD_ANYTHING <———– Prevents validation of .pdb file
0×00000100 – SYMOPT_NO_UNQUALIFIED_LOADS
0×00000200 – SYMOPT_FAIL_CRITICAL_ERRORS
0×00010000 – SYMOPT_AUTO_PUBLICS
0×00020000 – SYMOPT_NO_IMAGE_SEARCH

To re-enable strict mapping between .exe and .pdb use

0:000> .symopt- 0×40
Symbol options are 0×30377:
0×00000001 – SYMOPT_CASE_INSENSITIVE
0×00000002 – SYMOPT_UNDNAME
0×00000004 – SYMOPT_DEFERRED_LOADS
0×00000010 – SYMOPT_LOAD_LINES
0×00000020 – SYMOPT_OMAP_FIND_NEAREST
0×00000100 – SYMOPT_NO_UNQUALIFIED_LOADS
0×00000200 – SYMOPT_FAIL_CRITICAL_ERRORS
0×00010000 – SYMOPT_AUTO_PUBLICS
0×00020000 – SYMOPT_NO_IMAGE_SEARCH

Note the +/- in the above command. ‘+’ enables, ‘-’ disables.

VC11 Beta is now available

Nibu Thomas — Wed, 29 Feb 2012 22:07:13 +0000

What’s New: http://blogs.msdn.com/b/vcblog/archive/2012/02/29/10272778.aspx
Downloads: http://www.microsoft.com/visualstudio/11/en-us/downloads

How to list out binaries for which symbol loading failed

Nibu Thomas — Mon, 27 Feb 2012 16:59:57 +0000

Use ‘lml’ to list all dlls whose symbols has been loaded/failed to load, the list will also include dlls which failed symbol loading. See sample…

0:000> lml
start end module name
00000000`03d90000 00000000`040e3000 Test1 T (no symbols)
00000000`77d40000 00000000`77eb3000 kernel32 (private pdb symbols) c:\sym\kernel32.pdb\F0EC676938D745549823C7204D03B07B2\kernel32.pdb
00000000`77ec0000 00000000`77ffc000 ntdll (private pdb symbols) c:\sym\ntdll.pdb\C5666A2C21444EFAA53EB4F1CFBE56D22\ntdll.pdb
00000001`55600000 00000001`55801000 Test2 (export symbols) Test2.dll
00000001`80000000 00000001`806c2000 Test3 T (no symbols)
000007ff`57040000 000007ff`57071000 iphlpapi (private pdb symbols) c:\sym\iphlpapi.pdb\487BEF7A066A4E5DB7C0230E9B8564CA2\iphlpapi.pdb
000007ff`57140000 000007ff`573c5000 ole32 (private pdb symbols) c:\sym\ole32.pdb\7DDC15A822B0415CAD8C3BC2BF86C3082\ole32.pdb
000007ff`77310000 000007ff`77340000 ws2_32 (private pdb symbols) c:\sym\ws2_32.pdb\89321AB9C6CD443FB74F07BA57B507452\ws2_32.pdb
000007ff`7fd30000 000007ff`7fed0000 rpcrt4 (private pdb symbols) c:\sym\rpcrt4.pdb\8852BC6255D84F43A64A5FA4BE7D74162\rpcrt4.pdb

I’ve highlighted the dlls which failed symbol loading.

Use ‘lme’ if you want to list only those dlls which failed symbol loading. See sample…
0:000> lme
start end module name
00000000`03d90000 00000000`040e3000 Test1 T (no symbols)
00000001`55600000 00000001`55801000 Test2 (export symbols) Test2.dll
00000001`80000000 00000001`806c2000 Test3 T (no symbols)

How to search a range of addresses using ‘s’ command in WinDbg

Nibu Thomas — Thu, 23 Feb 2012 19:32:33 +0000

-> Please note for demo purpose we are using current thread stack range as address range: poi(@$teb+8) poi(@$teb+4) <-

Search for an ascii string beginning with "Rtl"
s -a poi(@$teb+8) poi(@$teb+4) "Rtl"
//Output
0fd3d906 52 74 6c 47 65 74 50 72-6f 64 75 63 74 49 6e 66 RtlGetProductInf

Search for a unicode string "AgentService"
s -u poi(@$teb+8) poi(@$teb+4) "AgentService"
//Output
0fd3ed7c 0041 0067 0065 006e 0074 0053 0065 0072 A.g.e.n.t.S.e.r.
0fd3edec 0041 0067 0065 006e 0074 0053 0065 0072 A.g.e.n.t.S.e.r.

Display all ascii strings which are at least 8 in length
s -[l8]sa poi(@$teb+8) poi(@$teb+4)
// Output
0fd3d0d4 "mscorlib.pdb"
0fd3d906 "RtlGetProductInfo"

Display all unicode strings which are at least 58 in length
s -[l58]su poi(@$teb+8) poi(@$teb+4)
// Output
0fd3bc08 "謬矐뻬࿓ilC:\Windows\WinSxS\x86_micr"
0fd3bc48 "osoft.vc80.crt_1fc8b3b9a1e18e3b_"
0fd3bc88 "8.0.50727.6195_none_d09154e04427"
0fd3bcc8 "2b9a"

How to enable LARGEADDRESSAWARE?

Nibu Thomas — Wed, 22 Feb 2012 15:58:14 +0000

The command to enable large address aware is as follows…

EditBin /LARGEADDRESSAWARE NotePad.exe

How to check if the above command worked or not? Run the above executable (in our case NotePad.exe) with DumpBin.exe.

C:\> DumpBin /Headers NotePad.exe

FILE HEADER VALUES
             14C machine (x86)
               4 number of sections
        4BA1DC16 time date stamp Thu Mar 18 02:53:58 2010
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             122 characteristics
                   Executable
Application can handle large (>2GB) addresses
                   32 bit word machine

See highlighted line.

systeminfo command

Nibu Thomas — Wed, 08 Feb 2012 22:25:58 +0000

To gather system information of a computer running windows use the command ‘SystemInfo’. The command gathers following information…

1. Operating system information
2. Processor information
3. Input local information
4. Installed hotfix information
5. Network card information

A good way to use this command is to redirect output to a file, for e.g. SystemInfo > D:\SystemInfo.txt. Another option is to run it straight from "Start->Run->cmd /c systeminfo > D:\nibu.txt"

Good for creating repro’s, VM’s and to know what hotfixes are installed on the machine.

To get help on the command use: SystemInfo /?

__noop intrinsic

Nibu Thomas — Thu, 05 Jan 2012 19:51:00 +0000

What do we mean by intrinsic?

Most functions are contained in libraries, but some functions are built in (that is, intrinsic) to the compiler. These are referred to as intrinsic functions or intrinsics.

Taken from MSDN…

The __noop intrinsic specifies that a function should be ignored and the argument list be parsed but no code be generated for the arguments. It is intended for use in global debug functions that take a variable number of arguments.

The compiler converts the __noop intrinsic to 0 at compile time. The following code shows how you could use __noop.

// compiler_intrinsics__noop.cpp
// compile with or without /DDEBUG
#include 

#if DEBUG
   #define PRINT   printf_s
#else
   #define PRINT   __noop
#endif

int main()
{
   PRINT("\nhello\n");
}

So if you have custom macros which should expand to nought in release version the proper way to do this would be via __noop. Remember this is Microsoft(R) specific.

.loadby sos clr fails! Why?

Nibu Thomas — Thu, 05 Jan 2012 18:30:00 +0000

You have a managed application crash dump and you would like to load sos.dll, to use the powerful commands it provides to help with managed debugging, but the load of sos.dll always fails. The command that you are executing for loading sos.dll is…

0:015> .loadby sos clr
Unable to find module ‘clr’

On enter you see the above error and you are not sure what is going on. So in order to understand the error message it is important to understand what .loadby command does.

“.loadby sos clr” means load sos.dll from where clr.dll is loaded. So as you might have guessed by now if clr.dll is not loaded then sos.dll cannot be found. This is what the error means when it says “Unable to find module ‘clr’”. All it means is clr.dll is not in the loaded module list which means there is no path to locate clr.dll.

So how can I fix this error? In order to fix this error you must understand that clr.dll has been introduced into .net applications from .net 4.0 and prior to that we used to have mscorwks.dll. So if your .net application is not a 4.0 app then clr.dll won’t be loaded, yes you will have to use mscorwks.dll instead…

0:015> .loadby sos mscorwks

But you are damn sure that the application that crashed is a .net 4.0 application but you still see the error! All I can say is clr.dll is not loaded. Wait for it to load or break on its load and then execute .loadby sos clr.

So how to break on a module load…
0:015> sxe ld clr

This will for sure help!

Hidden VC++ compiler switches: /d1reportSingleClassLayoutSomeType

Nibu Thomas — Tue, 15 Nov 2011 15:53:38 +0000

Did you ever want to know how a C++ class was laid out by VC++ compiler? There are few hidden switches which are not known to many hence would like to share those with my blog readers.

So I will blog about these switches one by one. So for today the switch I’m going to discuss is: /d1reportSingleClassLayoutSomeType. SomeType in the name is just a placeholder for actual class name.

So for a demo we know that there is a class called CDialog in MFC. So create a sample MFC project and add the following command line manually to the project’s settings. Goto C/C++->CommandLine->Additional Options and enter /d1reportSingleClassLayoutCDialog manually into the additional options edit control, as shown in the screenshot below…

Once you are done rebuild your project. When I rebuild this is what I see in my output window. You will see the structure of CDialog laid out in the output window. Please know that CDialog is a huge class with several virtual functions hence the output is pretty long.

1>------ Rebuild All started: Project: MFCTest, Configuration: Debug Win32 ------
1>  stdafx.cpp
1>  class CDialog size(148):
1>   +---
1>   | +--- (base class CWnd)
1>   | | +--- (base class CCmdTarget)
1>   | | | +--- (base class CObject)
1>   0 | | | | {vfptr}
1>   | | | +---
1>   4 | | | m_dwRef
1>   8 | | | m_pOuterUnknown
1>  12 | | | m_xInnerUnknown
1>  16 | | | XDispatch m_xDispatch
1>  20 | | | m_bResultExpected
1>  24 | | | XConnPtContainer m_xConnPtContainer
1>  28 | | | m_pModuleState
1>   | | +---
1>  32 | | m_hWnd
1>  36 | | m_bEnableActiveAccessibility
1>     | |  (size=3)
1>  40 | | m_pStdObject
1>  44 | | m_pProxy
1>  48 | | XAccessible m_xAccessible
1>  52 | | XAccessibleServer m_xAccessibleServer
1>  56 | | m_bIsTouchWindowRegistered
1>  60 | | CPoint m_ptGestureFrom
1>  68 | | m_ulGestureArg
1>  76 | | m_bGestureInited
1>  80 | | m_pCurrentGestureInfo
1>  84 | | m_hWndOwner
1>  88 | | m_nFlags
1>  92 | | m_pfnSuper
1>  96 | | m_nModalResult
1>  100 | | m_pDropTarget
1>  104 | | m_pCtrlCont
1>  108 | | m_pCtrlSite
1>  112 | | m_pMFCCtrlContainer
1>   | +---
1>  116 | m_nIDHelp
1>  120 | m_lpszTemplateName
1>  124 | m_hDialogTemplate
1>  128 | m_lpDialogTemplate
1>  132 | m_lpDialogInit
1>  136 | m_pParentWnd
1>  140 | m_hWndTop
1>  144 | m_pOccDialogInfo
1>   +---
1> 
1>  CDialog::$vftable@:
1>   | &CDialog_meta
1>   |  0
1>   0 | &CDialog::GetRuntimeClass
1>   1 | &CDialog::{dtor}
1>   2 | &CObject::Serialize
1>   3 | &CDialog::AssertValid
1>   4 | &CDialog::Dump
1>   5 | &CDialog::OnCmdMsg
1>   6 | &CWnd::OnFinalRelease
1>   7 | &CCmdTarget::IsInvokeAllowed
1>   8 | &CCmdTarget::GetDispatchIID
1>   9 | &CCmdTarget::GetTypeInfoCount
1>  10 | &CCmdTarget::GetTypeLibCache
1>  11 | &CCmdTarget::GetTypeLib
1>  12 | &CDialog::GetMessageMap
1>  13 | &CCmdTarget::GetCommandMap
1>  14 | &CCmdTarget::GetDispatchMap
1>  15 | &CCmdTarget::GetConnectionMap
1>  16 | &CWnd::GetInterfaceMap
1>  17 | &CCmdTarget::GetEventSinkMap
1>  18 | &CCmdTarget::OnCreateAggregates
1>  19 | &CCmdTarget::GetInterfaceHook
1>  20 | &CCmdTarget::GetExtraConnectionPoints
1>  21 | &CCmdTarget::GetConnectionHook
1>  22 | &CWnd::PreSubclassWindow
1>  23 | &CWnd::Create
1>  24 | &CWnd::CreateEx
1>  25 | &CWnd::CreateEx
1>  26 | &CWnd::DestroyWindow
1>  27 | &CWnd::PreCreateWindow
1>  28 | &CWnd::CalcWindowRect
1>  29 | &CWnd::GetMenu
1>  30 | &CWnd::SetMenu
1>  31 | &CWnd::OnToolHitTest
1>  32 | &CWnd::GetScrollBarCtrl
1>  33 | &CWnd::WinHelpW
1>  34 | &CWnd::HtmlHelpW
1>  35 | &CWnd::WinHelpInternal
1>  36 | &CWnd::ContinueModal
1>  37 | &CWnd::EndModalLoop
1>  38 | &CWnd::OnDrawIconicThumbnailOrLivePreview
1>  39 | &CWnd::EnsureStdObj
1>  40 | &CWnd::get_accParent
1>  41 | &CWnd::get_accChildCount
1>  42 | &CWnd::get_accChild
1>  43 | &CWnd::get_accName
1>  44 | &CWnd::get_accValue
1>  45 | &CWnd::get_accDescription
1>  46 | &CWnd::get_accRole
1>  47 | &CWnd::get_accState
1>  48 | &CWnd::get_accHelp
1>  49 | &CWnd::get_accHelpTopic
1>  50 | &CWnd::get_accKeyboardShortcut
1>  51 | &CWnd::get_accFocus
1>  52 | &CWnd::get_accSelection
1>  53 | &CWnd::get_accDefaultAction
1>  54 | &CWnd::accSelect
1>  55 | &CWnd::accLocation
1>  56 | &CWnd::accNavigate
1>  57 | &CWnd::accHitTest
1>  58 | &CWnd::accDoDefaultAction
1>  59 | &CWnd::put_accName
1>  60 | &CWnd::put_accValue
1>  61 | &CWnd::SetProxy
1>  62 | &CWnd::CreateAccessibleProxy
1>  63 | &CWnd::OnCommand
1>  64 | &CWnd::OnNotify
1>  65 | &CWnd::GetSuperWndProcAddr
1>  66 | &CWnd::DoDataExchange
1>  67 | &CWnd::BeginModalState
1>  68 | &CWnd::EndModalState
1>  69 | &CDialog::PreTranslateMessage
1>  70 | &CWnd::OnAmbientProperty
1>  71 | &CWnd::WindowProc
1>  72 | &CWnd::OnWndMsg
1>  73 | &CWnd::DefWindowProcW
1>  74 | &CWnd::PostNcDestroy
1>  75 | &CWnd::OnChildNotify
1>  76 | &CWnd::OnTouchInputs
1>  77 | &CWnd::OnTouchInput
1>  78 | &CWnd::GetGestureStatus
1>  79 | &CWnd::OnGestureZoom
1>  80 | &CWnd::OnGesturePan
1>  81 | &CWnd::OnGestureRotate
1>  82 | &CWnd::OnGestureTwoFingerTap
1>  83 | &CWnd::OnGesturePressAndTap
1>  84 | &CDialog::CheckAutoCenter
1>  85 | &CWnd::IsFrameWnd
1>  86 | &CWnd::CreateControlContainer
1>  87 | &CWnd::CreateControlSite
1>  88 | &CDialog::SetOccDialogInfo
1>  89 | &CDialog::GetOccDialogInfo
1>  90 | &CDialog::Create
1>  91 | &CDialog::Create
1>  92 | &CDialog::CreateIndirect
1>  93 | &CDialog::CreateIndirect
1>  94 | &CDialog::DoModal
1>  95 | &CDialog::OnInitDialog
1>  96 | &CDialog::OnSetFont
1>  97 | &CDialog::OnOK
1>  98 | &CDialog::OnCancel
1>  99 | &CDialog::PreInitDialog
1> 
1>  CDialog::GetRuntimeClass this adjustor: 0
1>  CDialog::Create this adjustor: 0
1>  CDialog::Create this adjustor: 0
1>  CDialog::CreateIndirect this adjustor: 0
1>  CDialog::CreateIndirect this adjustor: 0
1>  CDialog::DoModal this adjustor: 0
1>  CDialog::OnInitDialog this adjustor: 0
1>  CDialog::OnSetFont this adjustor: 0
1>  CDialog::OnOK this adjustor: 0
1>  CDialog::OnCancel this adjustor: 0
1>  CDialog::{dtor} this adjustor: 0
1>  CDialog::AssertValid this adjustor: 0
1>  CDialog::Dump this adjustor: 0
1>  CDialog::PreTranslateMessage this adjustor: 0
1>  CDialog::OnCmdMsg this adjustor: 0
1>  CDialog::CheckAutoCenter this adjustor: 0
1>  CDialog::SetOccDialogInfo this adjustor: 0
1>  CDialog::GetOccDialogInfo this adjustor: 0
1>  CDialog::PreInitDialog this adjustor: 0
1>  CDialog::GetMessageMap this adjustor: 0
1>  CDialog::__delDtor this adjustor: 0
1>  CDialog::__vecDelDtor this adjustor: 0
1> 
1> 
1>  class CDialogBar size(200):
1>   +---
1>   | +--- (base class CControlBar)
1>   | | +--- (base class CWnd)
1>   | | | +--- (base class CCmdTarget)
1>   | | | | +--- (base class CObject)
1>   0 | | | | | {vfptr}
1>   | | | | +---
1>   4 | | | | m_dwRef
1>   8 | | | | m_pOuterUnknown
1>  12 | | | | m_xInnerUnknown
1>  16 | | | | XDispatch m_xDispatch
1>  20 | | | | m_bResultExpected
1>  24 | | | | XConnPtContainer m_xConnPtContainer
1>  28 | | | | m_pModuleState
1>   | | | +---
1>  32 | | | m_hWnd
1>  36 | | | m_bEnableActiveAccessibility
1>     | | |  (size=3)
1>  40 | | | m_pStdObject
1>  44 | | | m_pProxy
1>  48 | | | XAccessible m_xAccessible
1>  52 | | | XAccessibleServer m_xAccessibleServer
1>  56 | | | m_bIsTouchWindowRegistered
1>  60 | | | CPoint m_ptGestureFrom
1>  68 | | | m_ulGestureArg
1>  76 | | | m_bGestureInited
1>  80 | | | m_pCurrentGestureInfo
1>  84 | | | m_hWndOwner
1>  88 | | | m_nFlags
1>  92 | | | m_pfnSuper
1>  96 | | | m_nModalResult
1>  100 | | | m_pDropTarget
1>  104 | | | m_pCtrlCont
1>  108 | | | m_pCtrlSite
1>  112 | | | m_pMFCCtrlContainer
1>   | | +---
1>  116 | | m_pInPlaceOwner
1>  120 | | m_bAutoDelete
1>  124 | | m_cxLeftBorder
1>  128 | | m_cxRightBorder
1>  132 | | m_cyTopBorder
1>  136 | | m_cyBottomBorder
1>  140 | | m_cxDefaultGap
1>  144 | | m_nMRUWidth
1>  148 | | m_nCount
1>  152 | | m_pData
1>  156 | | m_hReBarTheme
1>  160 | | m_nStateFlags
1>  164 | | m_dwStyle
1>  168 | | m_dwDockStyle
1>  172 | | m_pDockSite
1>  176 | | m_pDockBar
1>  180 | | m_pDockContext
1>   | +---
1>  184 | CSize m_sizeDefault
1>  192 | m_pOccDialogInfo
1>  196 | m_lpszTemplateName
1>   +---
1> 
1>  CDialogBar::$vftable@:
1>   | &CDialogBar_meta
1>   |  0
1>   0 | &CDialogBar::GetRuntimeClass
1>   1 | &CDialogBar::{dtor}
1>   2 | &CObject::Serialize
1>   3 | &CControlBar::AssertValid
1>   4 | &CControlBar::Dump
1>   5 | &CCmdTarget::OnCmdMsg
1>   6 | &CWnd::OnFinalRelease
1>   7 | &CCmdTarget::IsInvokeAllowed
1>   8 | &CCmdTarget::GetDispatchIID
1>   9 | &CCmdTarget::GetTypeInfoCount
1>  10 | &CCmdTarget::GetTypeLibCache
1>  11 | &CCmdTarget::GetTypeLib
1>  12 | &CDialogBar::GetMessageMap
1>  13 | &CCmdTarget::GetCommandMap
1>  14 | &CCmdTarget::GetDispatchMap
1>  15 | &CCmdTarget::GetConnectionMap
1>  16 | &CWnd::GetInterfaceMap
1>  17 | &CCmdTarget::GetEventSinkMap
1>  18 | &CCmdTarget::OnCreateAggregates
1>  19 | &CCmdTarget::GetInterfaceHook
1>  20 | &CCmdTarget::GetExtraConnectionPoints
1>  21 | &CCmdTarget::GetConnectionHook
1>  22 | &CWnd::PreSubclassWindow
1>  23 | &CWnd::Create
1>  24 | &CWnd::CreateEx
1>  25 | &CWnd::CreateEx
1>  26 | &CControlBar::DestroyWindow
1>  27 | &CControlBar::PreCreateWindow
1>  28 | &CWnd::CalcWindowRect
1>  29 | &CWnd::GetMenu
1>  30 | &CWnd::SetMenu
1>  31 | &CWnd::OnToolHitTest
1>  32 | &CWnd::GetScrollBarCtrl
1>  33 | &CWnd::WinHelpW
1>  34 | &CWnd::HtmlHelpW
1>  35 | &CWnd::WinHelpInternal
1>  36 | &CWnd::ContinueModal
1>  37 | &CWnd::EndModalLoop
1>  38 | &CWnd::OnDrawIconicThumbnailOrLivePreview
1>  39 | &CWnd::EnsureStdObj
1>  40 | &CWnd::get_accParent
1>  41 | &CWnd::get_accChildCount
1>  42 | &CWnd::get_accChild
1>  43 | &CWnd::get_accName
1>  44 | &CWnd::get_accValue
1>  45 | &CWnd::get_accDescription
1>  46 | &CWnd::get_accRole
1>  47 | &CWnd::get_accState
1>  48 | &CWnd::get_accHelp
1>  49 | &CWnd::get_accHelpTopic
1>  50 | &CWnd::get_accKeyboardShortcut
1>  51 | &CWnd::get_accFocus
1>  52 | &CWnd::get_accSelection
1>  53 | &CWnd::get_accDefaultAction
1>  54 | &CWnd::accSelect
1>  55 | &CWnd::accLocation
1>  56 | &CWnd::accNavigate
1>  57 | &CWnd::accHitTest
1>  58 | &CWnd::accDoDefaultAction
1>  59 | &CWnd::put_accName
1>  60 | &CWnd::put_accValue
1>  61 | &CWnd::SetProxy
1>  62 | &CWnd::CreateAccessibleProxy
1>  63 | &CWnd::OnCommand
1>  64 | &CWnd::OnNotify
1>  65 | &CWnd::GetSuperWndProcAddr
1>  66 | &CWnd::DoDataExchange
1>  67 | &CWnd::BeginModalState
1>  68 | &CWnd::EndModalState
1>  69 | &CControlBar::PreTranslateMessage
1>  70 | &CWnd::OnAmbientProperty
1>  71 | &CControlBar::WindowProc
1>  72 | &CWnd::OnWndMsg
1>  73 | &CWnd::DefWindowProcW
1>  74 | &CControlBar::PostNcDestroy
1>  75 | &CWnd::OnChildNotify
1>  76 | &CWnd::OnTouchInputs
1>  77 | &CWnd::OnTouchInput
1>  78 | &CWnd::GetGestureStatus
1>  79 | &CWnd::OnGestureZoom
1>  80 | &CWnd::OnGesturePan
1>  81 | &CWnd::OnGestureRotate
1>  82 | &CWnd::OnGestureTwoFingerTap
1>  83 | &CWnd::OnGesturePressAndTap
1>  84 | &CWnd::CheckAutoCenter
1>  85 | &CWnd::IsFrameWnd
1>  86 | &CWnd::CreateControlContainer
1>  87 | &CWnd::CreateControlSite
1>  88 | &CDialogBar::SetOccDialogInfo
1>  89 | &CWnd::GetOccDialogInfo
1>  90 | &CDialogBar::CalcFixedLayout
1>  91 | &CControlBar::CalcDynamicLayout
1>  92 | &CDialogBar::OnUpdateCmdUI
1>  93 | &CControlBar::CalcInsideRect
1>  94 | &CControlBar::DoPaint
1>  95 | &CControlBar::DrawBorders
1>  96 | &CControlBar::DrawGripper
1>  97 | &CControlBar::DrawNCGripper
1>  98 | &CControlBar::DrawThemedGripper
1>  99 | &CControlBar::DrawNonThemedGripper
1>  100 | &CControlBar::DelayShow
1>  101 | &CControlBar::IsVisible
1>  102 | &CControlBar::RecalcDelayShow
1>  103 | &CControlBar::IsDockBar
1>  104 | &CControlBar::OnBarStyleChange
1>  105 | &CControlBar::SetStatusText
1>  106 | &CDialogBar::Create
1>  107 | &CDialogBar::Create
1> 
1>  CDialogBar::GetRuntimeClass this adjustor: 0
1>  CDialogBar::Create this adjustor: 0
1>  CDialogBar::Create this adjustor: 0
1>  CDialogBar::{dtor} this adjustor: 0
1>  CDialogBar::CalcFixedLayout this adjustor: 0
1>  CDialogBar::OnUpdateCmdUI this adjustor: 0
1>  CDialogBar::SetOccDialogInfo this adjustor: 0
1>  CDialogBar::GetMessageMap this adjustor: 0
1>  CDialogBar::__delDtor this adjustor: 0
1>  CDialogBar::__vecDelDtor this adjustor: 0
1> 
1> 
1>  class CDialogImpl size(8):
1>   +---
1>   0 | {vfptr}
1>   4 | m_Dlg
1>   +---
1> 
1>  CDialogImpl::$vftable@:
1>   | &CDialogImpl_meta
1>   |  0
1>   0 | &CDialogImpl::{dtor}
1> 
1>  CDialogImpl::{dtor} this adjustor: 0
1>  CDialogImpl::__delDtor this adjustor: 0
1>  CDialogImpl::__vecDelDtor this adjustor: 0
1> 
1> 
1>  class CDialogEx size(184):
1>   +---
1>   | +--- (base class CDialog)
1>   | | +--- (base class CWnd)
1>   | | | +--- (base class CCmdTarget)
1>   | | | | +--- (base class CObject)
1>   0 | | | | | {vfptr}
1>   | | | | +---
1>   4 | | | | m_dwRef
1>   8 | | | | m_pOuterUnknown
1>  12 | | | | m_xInnerUnknown
1>  16 | | | | XDispatch m_xDispatch
1>  20 | | | | m_bResultExpected
1>  24 | | | | XConnPtContainer m_xConnPtContainer
1>  28 | | | | m_pModuleState
1>   | | | +---
1>  32 | | | m_hWnd
1>  36 | | | m_bEnableActiveAccessibility
1>     | | |  (size=3)
1>  40 | | | m_pStdObject
1>  44 | | | m_pProxy
1>  48 | | | XAccessible m_xAccessible
1>  52 | | | XAccessibleServer m_xAccessibleServer
1>  56 | | | m_bIsTouchWindowRegistered
1>  60 | | | CPoint m_ptGestureFrom
1>  68 | | | m_ulGestureArg
1>  76 | | | m_bGestureInited
1>  80 | | | m_pCurrentGestureInfo
1>  84 | | | m_hWndOwner
1>  88 | | | m_nFlags
1>  92 | | | m_pfnSuper
1>  96 | | | m_nModalResult
1>  100 | | | m_pDropTarget
1>  104 | | | m_pCtrlCont
1>  108 | | | m_pCtrlSite
1>  112 | | | m_pMFCCtrlContainer
1>   | | +---
1>  116 | | m_nIDHelp
1>  120 | | m_lpszTemplateName
1>  124 | | m_hDialogTemplate
1>  128 | | m_lpDialogTemplate
1>  132 | | m_lpDialogInit
1>  136 | | m_pParentWnd
1>  140 | | m_hWndTop
1>  144 | | m_pOccDialogInfo
1>   | +---
1>  148 | m_hBkgrBitmap
1>  152 | CSize m_sizeBkgrBitmap
1>  160 | CBrush m_brBkgr
1>  168 | BackgroundLocation m_BkgrLocation
1>  172 | CDialogImpl m_Impl
1>  180 | m_bAutoDestroyBmp
1>   +---
1> 
1>  CDialogEx::$vftable@:
1>   | &CDialogEx_meta
1>   |  0
1>   0 | &CDialogEx::GetRuntimeClass
1>   1 | &CDialogEx::{dtor}
1>   2 | &CObject::Serialize
1>   3 | &CDialog::AssertValid
1>   4 | &CDialog::Dump
1>   5 | &CDialog::OnCmdMsg
1>   6 | &CWnd::OnFinalRelease
1>   7 | &CCmdTarget::IsInvokeAllowed
1>   8 | &CCmdTarget::GetDispatchIID
1>   9 | &CCmdTarget::GetTypeInfoCount
1>  10 | &CCmdTarget::GetTypeLibCache
1>  11 | &CCmdTarget::GetTypeLib
1>  12 | &CDialogEx::GetMessageMap
1>  13 | &CCmdTarget::GetCommandMap
1>  14 | &CCmdTarget::GetDispatchMap
1>  15 | &CCmdTarget::GetConnectionMap
1>  16 | &CWnd::GetInterfaceMap
1>  17 | &CCmdTarget::GetEventSinkMap
1>  18 | &CCmdTarget::OnCreateAggregates
1>  19 | &CCmdTarget::GetInterfaceHook
1>  20 | &CCmdTarget::GetExtraConnectionPoints
1>  21 | &CCmdTarget::GetConnectionHook
1>  22 | &CWnd::PreSubclassWindow
1>  23 | &CWnd::Create
1>  24 | &CWnd::CreateEx
1>  25 | &CWnd::CreateEx
1>  26 | &CWnd::DestroyWindow
1>  27 | &CWnd::PreCreateWindow
1>  28 | &CWnd::CalcWindowRect
1>  29 | &CWnd::GetMenu
1>  30 | &CWnd::SetMenu
1>  31 | &CWnd::OnToolHitTest
1>  32 | &CWnd::GetScrollBarCtrl
1>  33 | &CWnd::WinHelpW
1>  34 | &CWnd::HtmlHelpW
1>  35 | &CWnd::WinHelpInternal
1>  36 | &CWnd::ContinueModal
1>  37 | &CWnd::EndModalLoop
1>  38 | &CWnd::OnDrawIconicThumbnailOrLivePreview
1>  39 | &CWnd::EnsureStdObj
1>  40 | &CWnd::get_accParent
1>  41 | &CWnd::get_accChildCount
1>  42 | &CWnd::get_accChild
1>  43 | &CWnd::get_accName
1>  44 | &CWnd::get_accValue
1>  45 | &CWnd::get_accDescription
1>  46 | &CWnd::get_accRole
1>  47 | &CWnd::get_accState
1>  48 | &CWnd::get_accHelp
1>  49 | &CWnd::get_accHelpTopic
1>  50 | &CWnd::get_accKeyboardShortcut
1>  51 | &CWnd::get_accFocus
1>  52 | &CWnd::get_accSelection
1>  53 | &CWnd::get_accDefaultAction
1>  54 | &CWnd::accSelect
1>  55 | &CWnd::accLocation
1>  56 | &CWnd::accNavigate
1>  57 | &CWnd::accHitTest
1>  58 | &CWnd::accDoDefaultAction
1>  59 | &CWnd::put_accName
1>  60 | &CWnd::put_accValue
1>  61 | &CWnd::SetProxy
1>  62 | &CWnd::CreateAccessibleProxy
1>  63 | &CDialogEx::OnCommand
1>  64 | &CWnd::OnNotify
1>  65 | &CWnd::GetSuperWndProcAddr
1>  66 | &CWnd::DoDataExchange
1>  67 | &CWnd::BeginModalState
1>  68 | &CWnd::EndModalState
1>  69 | &CDialogEx::PreTranslateMessage
1>  70 | &CWnd::OnAmbientProperty
1>  71 | &CWnd::WindowProc
1>  72 | &CWnd::OnWndMsg
1>  73 | &CWnd::DefWindowProcW
1>  74 | &CWnd::PostNcDestroy
1>  75 | &CWnd::OnChildNotify
1>  76 | &CWnd::OnTouchInputs
1>  77 | &CWnd::OnTouchInput
1>  78 | &CWnd::GetGestureStatus
1>  79 | &CWnd::OnGestureZoom
1>  80 | &CWnd::OnGesturePan
1>  81 | &CWnd::OnGestureRotate
1>  82 | &CWnd::OnGestureTwoFingerTap
1>  83 | &CWnd::OnGesturePressAndTap
1>  84 | &CDialog::CheckAutoCenter
1>  85 | &CWnd::IsFrameWnd
1>  86 | &CWnd::CreateControlContainer
1>  87 | &CWnd::CreateControlSite
1>  88 | &CDialog::SetOccDialogInfo
1>  89 | &CDialog::GetOccDialogInfo
1>  90 | &CDialog::Create
1>  91 | &CDialog::Create
1>  92 | &CDialog::CreateIndirect
1>  93 | &CDialog::CreateIndirect
1>  94 | &CDialog::DoModal
1>  95 | &CDialog::OnInitDialog
1>  96 | &CDialog::OnSetFont
1>  97 | &CDialog::OnOK
1>  98 | &CDialog::OnCancel
1>  99 | &CDialog::PreInitDialog
1> 
1>  CDialogEx::GetRuntimeClass this adjustor: 0
1>  CDialogEx::PreTranslateMessage this adjustor: 0
1>  CDialogEx::OnCommand this adjustor: 0
1>  CDialogEx::GetMessageMap this adjustor: 0
1>  CDialogEx::{dtor} this adjustor: 0
1>  CDialogEx::__delDtor this adjustor: 0
1>  CDialogEx::__vecDelDtor this adjustor: 0
1> 
1> 
1>  class CDialogTemplate size(12):
1>   +---
1>   0 | m_hTemplate
1>   4 | m_dwTemplateSize
1>   8 | m_bSystemFont
1>   +---
1> 
1> 
1> 
1>  MFCTestDlg.cpp
1>  MFCTest.cpp
1>  Generating Code...
1>  MFCTest.vcxproj -> C:\MFCTraining\MFCTest\Debug\MFCTest.exe
========== Rebuild All: 1 succeeded, 0 failed, 0 skipped ==========

Hope this helps you have a better understanding of how classes are laid out by the Visual C++ compiler.