1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

... General WinDbg's commands (clear screen, ..) 10) Loaded modules and image information 18) Memory 3) Debugging sessions (attach, detach, ..) 11) Process related information 19) Manipulating ...

2. WinDbg. From A to Z!
(Documents/Presentations)

...  Commands on threads and locks (31, 55) Memory: Stack details (37, 39, 41) Memory: General commands (43) Memory: Heap commands and examples (45, 49, 51, 53) Useful commands for ...

3. !heap failed in windbg. Invalid type information f
(Forum/Crash Dump Analysis )

Hello, I'm trying to dump heap information from full dump memory file sitting on Windows Server 2003 SP2 x86. Dump was created for 32-bit mixed (native/clr) application which was running on Windows ...

4. Heap Debugging Windows 7
(Forum/General Questions)

hello there .. Here anybody tried to examine (using Windbg) , how heap manager allocates heap memory ?? ...

5. Help with crash dump
(Forum/Crash Dump Analysis )

Hi, I am have a regular crash of my machine every 2-3 days. below is the analysis of the problem "Open Crash Dump ...". Can anyone suggest the problem? Is it faulty memory or a driver fault? kd> ...

6. Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... am running WinDbg on Windows 7 64 as an Administrator, and it is connecting to a VMWare Windows XP 32-bit system. I am not sure why I would get access errors to this memory? ...

7. Memory Searching issue (command s)
(Forum/Kernel-Mode Debugging)

Hello! When I try to use the 's' command to search memory, it was coming up with no results. Upon dumping the memory region where I knew the byte-sequence I was looking for is located, the memory there ...

8. Re: break on driver load - question from kam
(Forum/Article Discussions)

... memory (be it an EXE, DLL, or kernel mode driver) and calls its entry point thereafter. In other words by the time DriverEntry is called the driver will always be loaded. If all you need is break into ...

9. Re: CrashMe Application
(Forum/Article Discussions)

Hello everybody I can't see 10 Mb memory in dump which allocate operator new. I do next step 1) Start "CrashMe.exe" in debug mode 2) Attach with WinDbg 3) Press button "operator new*" 4) Press ...

10. Re: hide debugging
(Forum/General Questions)

Welcome Eleanor, I'm afraid not. The best you can do is attach WinDbg noninvasively. With noninvasive debugging the target applications gets frozen and WinDbg is able to read and examine memory and various ...

11. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... is actually used (its virtual addresses space paged-in etc.). A simple .process ?? and .reload /user should fix your memory issues described. A few more words The transition from user-mode to kernel-mode ...

12. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... try as well. To do this you must ensure the context of your process is actually used (its virtual addresses space paged-in etc.). A simple .process ?? and .reload /user should fix your memory issues ...

13. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... uses the page tables for this process to interpret all user-mode memory addresses, so you can read and write to this memory. In short the following picture explains it: [USER POSTED IMAGE] Note ...

14. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

Thanks again for you help, I fully understand it now!

15. Re: See in Memory Descriptor List whats on
(Forum/Kernel-Mode Debugging)

Steffen welcome. It is easy to find out which driver is leaking or consuming a lot of memory. Theory In order to use Pool tags one generally has to enable them with GFlags -> System Registry -> ...

16. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

Welcome Carl. You might try the !dll -l command. It lists all currently loaded dlls sorted by their load order, though enough memory information must be present in the dump for the command to work (.dump ...

17. Re: Video or Sound from 'A to Z' presentation?
(Forum/Suggestion Box)

It would be useful if you could add a narative. But I was also thinking that an article on the limits of a mini dump vs full memory dump might also be useful. Cheers. ...

18. Re: windbg question from kam
(Forum/Article Discussions)

... can easily get the base address of your driver too: > !lmi 77fba431 OR > lm vm 77fba431 Both commands will return the base/start address of your driver in memory. Then you would do something like ...

19. See in Memory Descriptor List whats on
(Forum/Kernel-Mode Debugging)

... the mdl. can i analyze this problem with a full memory dump or should i take the driver verifier for this? thank you very much for your help. sorry about my english. ...

20. Symbol not found
(Forum/Symbol and Source Files )

... is a symbol code that have a run-time protected access memory error : #include void main() { //point to location 0 int *ptr1; printf("Hello World\n"); //read from Location 0 (Protected ...

21. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... suggests a memory issue. Is there anything I might reconfigure (or download) to get past this error? ...

22. unknown stream type 0x13 and other weird messages
(Forum/Crash Dump Analysis )

... Mini Dump File with Full Memory: Only application data is available WARNING: Minidump contains unknown stream type 0x13 Comment: '1st_chance_Process_Shut_Down_exception_in_VWJS.EXE_running_on_USDAWAPP1003' Windows ...

23. Using WinDbg to examine ASP.NET applications
(Forum/Debugging of Managed-Code )

I am trying to really study ASP.NET from a variety of levels. I am trying to answer some simple questions, such as, how can I tell how much memory an application uses upon instantiation? How can I tell ...

24. WinDbg !threads for ASP.NET 4 memory dump
(Forum/Debugging of Managed-Code )

!ASPXPages from psscor4 doesn't display threadID's for threads that are queued or completed. However !threads seems to show a threadID all the time. Does it include threads that are queued? idle in the ...

25. Windbg for memory analysis using mimikatz ERROR
(Forum/Crash Dump Analysis )

I'm using windbg version 6.12 and using mimilib.dll for debugging memory. All works fine until I get following output on UI 0:000> !mimikatz DPAPI Backup keys ================= Current prefered ...