Surprisingly, after almost a decade of using WinDBG I have never had to use a negative decimal value in a WinDBG expression. Until recently, that is…Because the MASM syntax was a bit trickier than expected, I thought I’d record it here for posterity.
When using the MASM evaluator (which is the default in WinDBG), hex values are the default and decimal numbers are indicated by using the 0n override. Thus, for example, if I wanted to evaluate 123 in an expression I could use 0n123:
3: kd> ?0n123
Evaluate expression: 123 = 00000000`0000007b
However, if I want to use -123 there’s a bit of a catch. My natural inclination was to put the minus sign to the right of the 0n and the left of the 123, such as this: 0n-123. However, this yields an unexpected result:
3: kd> ?0n-123
Evaluate expression: -291 = ffffffff`fffffedd
That’s actually -0×123, not -123. To make matters even worse, the latest debugger even shows this syntax when displaying negative decimal values:
3: kd> dt nt!_mdl fffffa80077f1df0
+0×000 Next : (null)
+0×008 Size : 0n56
+0x00a MdlFlags : 0n-32701
+0×010 Process : 0xfffffa80`069dab30 _EPROCESS
+0×018 MappedSystemVa : 0xfffffa80`06797294 Void
+0×020 StartVa : 0×00000000`0404f000 Void
+0×028 ByteCount : 0x1c
+0x02c ByteOffset : 0x79c
However, the correct syntax is to put the minus sign to the left of the 0n:
3: kd> ?-0n123
Evaluate expression: -123 = ffffffff`ffffff85
For the C++ evaluator, things are much easier because the default radix is decimal. Thus, all you need to do is specify -123:
3: kd> ? @@c++(-123)
Evaluate expression: -123 = ffffffff`ffffff85
The trick now comes when you want to specify a negative hex number, which also requires the minus sign to be on the left of the modifier:
3: kd> ? @@c++(0x-123)
Evaluate expression: -123 = ffffffff`ffffff85
3: kd> ? @@c++(-0×123)
Evaluate expression: -291 = ffffffff`fffffedd