1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

... /e ExtDLL FunctionFilter .extmatch /D /e ExtDLL FunctionFilter Show all exported functions of an extension DLL. FunctionFilter = wildcard string Same ...

2. Can all commands be watched with WinDbg
(Forum/General Questions)

... performed by the program as it launches? If so, is it only in assembly, or, is there a way to approach the call by call from say a module function call level? To me, this would be a great way to figure ...

3. Creating a process server
(Forum/Writting Extensions)

Hi, I'm trying to create a process server. To do this I create a client object and call the StartProcessServer() function. if ( (status = DebugCreate(__uuidof(IDebugClient), (void**)&client)) ...

4. Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

Is it possible to debug DLLs (made from C code) that had to be compiled with minGW GCC (because they are C99 and MS doesn't support C99) in Visual Studio? All I see in VS is the disassembly and function ...

5. Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

I have a Vista SP1 workstation on which I would like to shrink the primary partition. I have run a few tools to try and consolidate data to the front of the drive so I can then run the shrink functionality ...

6. Developing WinDBG extensions in Visual Studio
(Forum/Writting Extensions)

... forget to add __declspec(dllexport) in all function definitions that should be visible to WinDBG :) ...

7. Dll export table - Exported functions list and @
(Forum/Kernel-Mode Debugging)

Hello Can we extract exported functions list from a dll and their asociated addresses using windbg? Can we determine what dlls's functions are used by an application? for exemple: myapp.exe ...

8. Function offsets and return address in callstack
(Forum/User-Mode Debugging)

Hello there, I have a question : Given a callstack for example : 0007f5b0 00c13e82 000f0406 0007f624 00000111 notepad!InvokeOpenDialog+0x25 (FPO: [Non-Fpo]) 0007f62c 00c1164a 000f0406 00000002 ...

9. function plus offset question
(Forum/Crash Dump Analysis )

Hi, when I'm looking at a threads call stack what do the numbers after the function mean? As indicated below as libxx!classxx::Perform+0x4fe and libxx!classxx::Perform+0x60c what are the +0x4fe ...

10. How do source code files help?
(Forum/Debugging of Managed-Code )

I have a little console application throwing an error when trying to open a file. I am certain it's just an issue where the original handle was never closed in a previous function. To try and expose ...

11. How to disable FPO optimisation on x64 VC++ compil
(Forum/General Questions)

Hi, Recently I started using Windbg(x64), To play with it, I have compiled(x64) a sample program using cl.exe ls.c /Zi /Od /GS- Interestingly the functions generated for the executable contain ...

12. One command for Stack
(Forum/General Questions)

Hello all! I need a command that show me all functions of stack when im debuggin windows with my driver from start until fynal of a breakpoint. can you help me??? ...

13. Re: Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... function you could execute a !gle (get last error) in WinDbg. With some luck you will get a hint about what failed. With less luck you might end up debugging FSCTL_DELETE_USN_JOURNAL throughout kernel ...

14. Re: function plus offset question
(Forum/Crash Dump Analysis )

The 0x* numbers are the offsets within a function code where a 'call' instruction is issued. ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject+0xc This means that ZwWaitForSingleObject calls ...

15. Re: function plus offset question
(Forum/Crash Dump Analysis )

And you're talking bytes as in the function + number of bytes of compiled code at runtime/debugging, not number of bytes of src correct? Thanks. ...

16. Re: function plus offset question
(Forum/Crash Dump Analysis )

Yeap... exactly.

17. Re: function plus offset question
(Forum/Crash Dump Analysis )

Great! Thanks for the help. I have so much trouble sorting through these details in the normal help file / chm. Thanks again!

18. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... a look at ntdll.dll and its implementation we see something like this on Windows XP SP3: [USER POSTED IMAGE] Note how a different value is stored into register EAX for each function? Basically this ...

19. Re: Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

... check out the .symfix+ command... If you aren't able to get the right PDB files any serious debugger will read at least the export symbols (functions) of your modules. Example: If you open MSVCR80.DLL ...

20. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

... with a BaseAddress in kernel32 d) finally the main thread executes a jump from kernel32 to the entry function of your application (main, WinMain, etc) If I open an executable from WinDbg, is there ...

21. Re:Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

Edward, welcome. The short answer is it depends. PDB is Microsoft's proprietary format and is not documented. While MS offers APIs to read and extract data from PDBs (see DIA SDK - Debug Interface Access ...

22. Re:How do source code files help?
(Forum/Debugging of Managed-Code )

... stacks with functions names, source code information, and so on in almost the same way as you see it for C++ applications. To keep it short: You can use WinDbg to obtain some extra information for ...

23. windbg question
(Forum/Article Discussions)

... of driver loading function, just before it's calling drivers' EP, and breakpoint there. The problem is that this method will break on every driver that is going to be loaded... ...

24. Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

I'm debugging an application for which I have no source. The app is crashing in a dll. In IDA pro I see: call ds:__imp_strncpy which is the culprit of the crash however in WinDBG I see: call ...