1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

... Main extensions 14) Tracing and stepping (F10, F11) 22) Logging extension (logexts.dll) 7) Symbols 15) Call stack 8) Sources 16) Registers 1) Built-in ...

2. WinDbg. From A to Z!
(Documents/Presentations)

...  Commands on threads and locks (31, 55) Memory: Stack details (37, 39, 41) Memory: General commands (43) Memory: Heap commands and examples (45, 49, 51, 53) Useful commands for ...

3. ASP hang
(Forum/Crash Dump Analysis )

... 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 0 FAULTING_THREAD: 00000000000068c8 DEFAULT_BUCKET_ID: ZEROED_STACK PROCESS_NAME: w3wp.exe OVERLAPPED_MODULE: ...

4. AVIStreamWrite exception.. need help !!
(Forum/User-Mode Debugging)

...  ???????? ???????? ???????? ???????? 092000b8 ???????? ???????? ???????? ???????? Stack Trace -------------- 0:007> k ChildEBP RetAddr WARNING: Stack unwind information not available. Following ...

5. Bugcheck Analysis
(Forum/Crash Dump Analysis )

... Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel ...

6. Crash location !
(Forum/Crash Dump Analysis )

... EIP=012C300B FLG=00010206 CS =001B DS =0023 SS =0023 ES =0023 FS =003B GS =0000 Call Stack: 001B:012C300B (0x00910048 0x009AE718 0x009AE6E0 0x009AE6EC) some.dll 001B:01A11027 ...

7. Function offsets and return address in callstack
(Forum/User-Mode Debugging)

Hello there, I have a question : Given a callstack for example : 0007f5b0 00c13e82 000f0406 0007f624 00000111 notepad!InvokeOpenDialog+0x25 (FPO: [Non-Fpo]) 0007f62c 00c1164a 000f0406 00000002 ...

8. function plus offset question
(Forum/Crash Dump Analysis )

Hi, when I'm looking at a threads call stack what do the numbers after the function mean? As indicated below as libxx!classxx::Perform+0x4fe and libxx!classxx::Perform+0x60c what are the +0x4fe ...

9. Help with crash dump
(Forum/Crash Dump Analysis )

... kernel debugger is available get the stack backtrace. Arguments: Arg1: 00000140, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: 804eb5b9, ...

10. How to find parameter values to a method?
(Forum/Debugging of Managed-Code )

Hi all, I faced an .net exception in my application in the customer machine. Without closing the exception I attached Windbg and I saw the clrstack. The method in which exception has occurred accepts ...

11. Minidump error
(Forum/Crash Dump Analysis )

...  cmp dword ptr [esi+8],eax ds:0023:fffffff0=???????? Resetting default scope LAST_CONTROL_TRANSFER: from e085eced to e0827c63 STACK_TEXT: eeb9dba0 e085eced 00000050 fffffff0 00000000 ...

12. One command for Stack
(Forum/General Questions)

Hello all! I need a command that show me all functions of stack when im debuggin windows with my driver from start until fynal of a breakpoint. can you help me??? ...

13. Random Thread getting stuck
(Forum/User-Mode Debugging)

... so Audio Receiving threads) just stops. It doesn't exit but its not running either! Using WinDbg I can see the following call stack for the stuck thread: ntdll!NtWaitForMultipleObjects+0x15 (FPO: ...

14. Re: Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... mode. The stack in the kernel looks something like this: 1: kd> kb ChildEBP RetAddr Args to Child acb11adc b9dbdca6 88928a38 88666008 acb11b20 Ntfs!NtfsDeleteUsnJournal acb11af0 b9da7adc 88928a38 ...

15. Re: How to find parameter values to a method?
(Forum/Debugging of Managed-Code )

Hi, !dso should show you all the objects on the managed stack. You'll find your string there. Cs. ...

16. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... is accomplished trough an opcode called sysenter/sysexecute (Intel/AMD). You can see this if you debug a few steps into kernel32!CreateFileW. The call stack will then look like this: 0:000> k ChildEBP ...

17. Re: One command for Stack
(Forum/General Questions)

Hi Victor, check the 15) Call stack commands in our "Common WinDbg Commands" list. For instance, you might try "kn", "kb".. I hope this helps, Robert ...

18. Re: Random Thread getting stuck
(Forum/User-Mode Debugging)

Hi Ben, Have you solved this problem? According to the call stack, the thread is waiting for something. If you can attach a debugger, try kb and !handle to see the objects which block the thread. ...

19. Re:How do source code files help?
(Forum/Debugging of Managed-Code )

... stacks with functions names, source code information, and so on in almost the same way as you see it for C++ applications. To keep it short: You can use WinDbg to obtain some extra information for ...

20. Remote debugging of CrashMe with ntsd -d
(Forum/Article Discussions)

... sides, I use the same version of windbg everywhere, etc. Why is it that piping the ouput through ntsd makes me loose the link between source and symbols ? ps : I asked the same question on stack ...

21. StackOverFlowException in .Net
(Forum/Crash Dump Analysis )

Hi, I've a question about finding StackOverFlowException in .net programs. I have a simple program test that generates a StackOverFlowException when I click a button: private void button1_Click(object ...

22. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... Dump File: Only registers and stack trace are available Symbol search path is: srv*;srv*c:\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Unable to load image \WINDOWS\system32\ntoskrnl.exe, ...

23. windbg question
(Forum/Article Discussions)

... to be already loaded, right? so why would I set a bp on entry point then... The only method that works that I've found so far, is "bp" on a driver with symbols, walking up the stack and find the address ...

24. WinDbg showing Wrong Info
(Forum/User-Mode Debugging)

I've got a program that I'm trying to debug but when I attach WinDbg to the process and look at the call stack for the thread that I'm interested in I sometimes see that the 'this' pointer is NULL, or ...