1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

Thematically grouped WinDbg command list - keep this on your desk if you use WinDbg! 1) Built-in help commands 9) Exceptions, events, and crash analysis 17) Information about variables 2) ...

2. Contact & Imprint
(Misc/Legal)

...   Liability and content disclaimer The content of this web site is provided as an information guide only. No legal liability or other responsibility is accepted for any errors, omissions, ...

3. !heap failed in windbg. Invalid type information f
(Forum/Crash Dump Analysis )

Hello, I'm trying to dump heap information from full dump memory file sitting on Windows Server 2003 SP2 x86. Dump was created for 32-bit mixed (native/clr) application which was running on Windows ...

4. ASP hang
(Forum/Crash Dump Analysis )

... 67a86482 ntdll_7d600000!RtlEnterCriticalSection+0xa8 WARNING: Stack unwind information not available. Following frames may be wrong. 013ef594 7c4239cb hotlinkprot!TerminateFilter+0x5462 013ef5e4 fa375121 ...

5. AVIStreamWrite exception.. need help !!
(Forum/User-Mode Debugging)

...  ???????? ???????? ???????? ???????? 092000b8 ???????? ???????? ???????? ???????? Stack Trace -------------- 0:007> k ChildEBP RetAddr WARNING: Stack unwind information not available. Following ...

6. Bugcheck Analysis
(Forum/Crash Dump Analysis )

...  * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 10000050, Could ...

7. Crash location !
(Forum/Crash Dump Analysis )

Hello Folks, I have a crash file which gives me the following information. ================================================================================ An Exception Occurred: Reason: some.exe ...

8. Function offsets and return address in callstack
(Forum/User-Mode Debugging)

... 00c11465 ? Is this always rule when inspecting callstack information for a thread in windbg (assuming callstack information is valid and also correct symbols are loaded)? An example of this would be very ...

9. Is it possible to view Mutant states from a Crash
(Forum/User-Mode Debugging)

...  Object Specific Information Mutex is Owned ..then I can see that my application does indeed own the Mutex. Great. Now then.. I would like to be able to do the same thing but my generating a ...

10. Its the best
(Forum/Article Discussions)

I was looking for Windbg tutorial from long time and with all that scattered information I was more confused. Thanks a lot for this wonderful presentation. Cheers! Shambhu ...

11. Minidump error
(Forum/Crash Dump Analysis )

... f3a552b3 00000000 00000000 00000000 nt!ObOpenObjectByPointer+0x27 WARNING: Stack unwind information not available. Following frames may be wrong. eeb9dd90 f3a553fb 00001fa4 00000ece 00006944 hknlgi+0x2b3 eeb9ddac ...

12. Parsing SYSTEM_PROCESS_INFORMATION!
(Forum/Kernel-Mode Debugging)

Hi guys! I'am trying to print processes list usig the SYSTEM_PROCESS_INFORMATION structures contained in SYSTEM_INFORMATION_CLASS (this list is used by task manager to get processe list) just by using ...

13. Random Thread getting stuck
(Forum/User-Mode Debugging)

... unwind information not available. Following frames may be wrong. boost_thread_vc90_mt_1_47!boost::this_thread::interruptible_wait+0x199 boost_thread_vc90_mt_1_47!boost::thread::get_thread_info+0x144 boost_thread_vc90_mt_1_47!boost::thread::join+0x6c Firstly, ...

14. Re: break on driver load - question from kam
(Forum/Article Discussions)

Kam, In general you don't need symbols to know the entry point of a PE image. The entry point is conveniently stored to the PE header and can be read from it. Further the OS loader loads an image into ...

15. Re: Can handled exceptions be seen with WinDbg
(Forum/Debugging of Managed-Code )

More about....Exception HandlingException Handling Dov

16. Re: Crash location !
(Forum/Crash Dump Analysis )

... but it should look something like: cscript adplus.vbs -crash -pn some.exe When you open the dump file, you should see more information and line numbers if you have PDB files, which will help you ...

17. Re: Finding undocumented swtiches
(Forum/General Questions)

By switches I mean command passed to the application with the shell. For instance, if I were to use IPConfig, a switch I could use, in this context, is /all to return all IPconfig information. I am thinking ...

18. Re: Finding undocumented swtiches
(Forum/General Questions)

... use the [b]!peb command. It reveals many process related information, among others the command line parameters. I hope this helps, Robert ...

19. Re: See in Memory Descriptor List whats on
(Forum/Kernel-Mode Debugging)

... information about currently verified drivers" -> Next (3x). Now you will see the pool usage of each driver: [USER POSTED IMAGE] [u]In WinDbg After enabling driver verifier you can get even ...

20. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

Welcome Carl. You might try the !dll -l command. It lists all currently loaded dlls sorted by their load order, though enough memory information must be present in the dump for the command to work (.dump ...

21. Re: Symbol not found
(Forum/Symbol and Source Files )

... check: - that there is indeed a PDB file that is generated alongside your exe (both should have same timestamps) - your compiler settings - debug information: /Zi (Program Database) should be set, ...

22. Re: Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

... in Dependency Walker you see all its exported functions. This is the same information that is read and used by IDA or by WinDbg if they fail to get the PDBs. For example in WinDbg: 0:000> ld MSVCR80 *** ...

23. Re:Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

... that GNU tools them self would be able to emit PDBs any time soon. On the other side it should be much easier to make a WinDbg extension which reads the GNU debug information and feeds it to WinDbg's ...

24. Re:How do source code files help?
(Forum/Debugging of Managed-Code )

... stacks with functions names, source code information, and so on in almost the same way as you see it for C++ applications. To keep it short: You can use WinDbg to obtain some extra information for ...

25. Re:Question about COFF deprecation
(Forum/Symbol and Source Files )

... Windows operating systems." The PE headers and structures are read by the Windows loader (ntdll) - it contains all the information needed to spawn a new process. Note that the PE format hasn't changed ...

26. Re:Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... executable itself (in this case "ntoskrnl.exe"), so that WinDbg is able to show you the disassembly and so on b) The PDB files -> to get even more information about the executables in question Here ...

27. Re:Using WinDbg to examine ASP.NET applications
(Forum/Debugging of Managed-Code )

Will, Hi. The worker process for ASP.NET applications is aspnet_wp.exe which internally heavily relies on mscorwks.dll. TODOs: For instance you could use the following WinDbg commands after a ...

28. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... !analyze -v to get detailed debugging information. BugCheck 1000008E, ***** Kernel symbols are WRONG. Please fix symbols to do analysis. I have downloaded and pointed to the correct, checked ...

29. Windbg + Crash Dump
(Forum/Crash Dump Analysis )

Hi, I've lots of question about some informations i can extract from a complete crash dump. I will be glad if someone can help me. I'm using windbg with crash dump. I set Symbol search path is: ...