I see KERNELBASE!UnhandledExceptionFilter on the stack. It is like focusing.
If it's x86, you can easily get the EXCEPTION_POINTERS structure from the first parameter in KERNELBASE!UnhandledExceptionFilter . From there you will have access to EXCEPTION_RECORD and CONTEXT . The procedure is described in this KB article.
The same method works for x64 processes with one caveat. Due to the nature of the x64 usage agreement , it is more difficult to get the actual argument KERNELBASE!UnhandledExceptionFilter , because it is stored in a register, not on the stack.
I recently found a CMKD debugger CMKD that automates the task of finding the first 4 arguments in an agreement to call x64, rather than blindly displaying stack values such as kb and kv . This can be done manually , but this is a rather long and error-prone process - it is better to allow the extension to crack it first.
With it, you can do something like this:
0:000> !cmkd.stack -p Call Stack : 15 frames ## Stack-Pointer Return-Address Call-Site [...] 03 000000aea3dae7e0 00007fff1e906b14 KERNELBASE!UnhandledExceptionFilter+196 Parameter[0] = 000000aea3dae930 Parameter[1] = (unknown) Parameter[2] = (unknown) Parameter[3] = (unknown) [...]
And now we have EXCEPTION_POINTERS* in Parameter[0] .
0:000> dt 000000ae`a3dae930 EXCEPTION_POINTERS ConsoleApplication2!EXCEPTION_POINTERS +0x000 ExceptionRecord : 0x000000ae`a3daf850 _EXCEPTION_RECORD +0x008 ContextRecord : 0x000000ae`a3daf240 _CONTEXT
In my example, we see that the C ++ exception was ...
0:000> .exr 000000ae`a3daf850 ExceptionAddress: 00007fff1bfeab78 (KERNELBASE!RaiseException+0x0000000000000068) ExceptionCode: e06d7363 (C++ EH exception) ExceptionFlags: 00000001 NumberParameters: 4 Parameter[0]: 0000000019930520 Parameter[1]: 000000aea3daf9b0 Parameter[2]: 00007ff6f50024a8 Parameter[3]: 00007ff6f5000000 pExceptionObject: 000000aea3daf9b0 _s_ThrowInfo : 00007ff6f50024a8
Hope this helps. Good luck. :)