1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

... Main extensions 14) Tracing and stepping (F10, F11) 22) Logging extension (logexts.dll) 7) Symbols 15) Call stack 8) Sources 16) Registers 1) Built-in ...

2. CrashMe Application
(Applications and Tools/General Applications)

... binaries, symbols, and sources Note: If you have an interesting situation that CrashMe doesn't cover please drop us a line or send us your code. Other CrashMe fans might be thankful for your contribution. ...

3. WinDbg. From A to Z!
(Documents/Presentations)

... "WinDbg. From A to Z!" turns out to be just as useful as WinDbg itself because it explains everything from simple things that you should know right away such as setting up symbols and the theory of command ...

4. !heap failed in windbg. Invalid type information f
(Forum/Crash Dump Analysis )

... Server 2003 SP2 x64 machine. From the following windbg log I see that loaded ntdll.dll image is incorrect and does not correspond to ntdll.pdb symbols. I have tried to specify the location to ntdll.dll ...

5. ASP hang
(Forum/Crash Dump Analysis )

... pool. The server is Windows 2003 and IIS6. Many thanks in advance. Here's the output: 0:000:x86> !analyze -v *** WARNING: symbols timestamp is wrong 0x499007dc 0x49900d5a for ntdll.dll ******************************************************************************* * ...

6. AVIStreamWrite exception.. need help !!
(Forum/User-Mode Debugging)

...  ds=0023 es=0023 fs=003b gs=0000 efl=00010286 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\iccvid.dll - iccvid+0x2792: 73c02792 66a5 ...

7. Bugcheck Analysis
(Forum/Crash Dump Analysis )

... Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel ...

8. Crash Dump - Analysis Error - Advice Please
(Forum/Crash Dump Analysis )

WinDbug Error – Advice Please I created a folder for Symbols located as below: C:\Windows In WinDbg I set a symbol path as below: SRV*C:\Windows\Symbols*http://msdl.microsoft.com/download/symbols/packages/WindowsVista/WindowsVista.6002.090410-1830.x86fre.Symbols.exe When ...

9. Function offsets and return address in callstack
(Forum/User-Mode Debugging)

... 00c11465 ? Is this always rule when inspecting callstack information for a thread in windbg (assuming callstack information is valid and also correct symbols are loaded)? An example of this would be very ...

10. ntdll.dll symbols are missing?
(Forum/Symbol and Source Files )

Hi all. I have a problem with ntdll.dll symbols. Actually, I just have no .pdb files for it, however all of pdb's are downloaded from microsoft site (I use symbol server for windbg, actually). And when ...

11. Re: break on driver load - question from kam
(Forum/Article Discussions)

Kam, In general you don't need symbols to know the entry point of a PE image. The entry point is conveniently stored to the PE header and can be read from it. Further the OS loader loads an image into ...

12. Re: kernel32 symbol in live kernel debug
(Forum/Symbol and Source Files )

... process should load kernel32.dll; applications that have a GUI also load user32.dll). Symbols are loaded into a debugger mainly for two purposes: What you are asking about somehow violates this basic ...

13. Re: ntdll.dll symbols are missing?
(Forum/Symbol and Source Files )

Oh... I've already solved the problem with windbg - I just downloaded local symbols and then gave them to symstore. It's okay now, but !peb doesn't work, neither dt _PEB or dt nt!_PEB, however lml shows ...

14. Re: Symbol not found
(Forum/Symbol and Source Files )

... folder. Alternatively you could try to debug our CrashMe application first - the symbols there should be loaded just fine. Then you can move back to your application and pinpoint the problem there. Also ...

15. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... symbols from Microsoft's symbols server. We have download the symbols to an identical Stratus server and ran the livekd kernel dump successfully...even moving the symbols directory/path around at will. ...

16. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... a hex-editor for example? We need to run a kernel dump (we are using livekd) on a secure Status server that we CANNOT open up to the internet in order to download symbols from Microsoft's symbols ...

17. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... the symbols on the 'open' server and test them on a test 'secure' server successfully. We now need to find out if there will be a descrepancy between Windows Server 2003 R2 sp2 and Windows Server 2003 ...

18. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

Chris, you are welcome. I hope you applied correct symbols to all your environments in the meantime. I didn't try it but I guess you ended up with two different symbol sets for Windows Server 2003 ...

19. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

There does NOT appear to be a descrepancy for the 'R2' variant. We were able to sucessfully download symbols from Microsoft Symbols Server on server A and import/utilize them on server B. The symbols ...

20. Re: Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

JD, welcome. Whenever you see a large offset like this mydll!wrongfuncanme+0x33360 it is always a sign of missing symbols. Now strncpy is part of the CRT library and thus resides in MSVCR80.DLL ...

21. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

... kernel32, and other system DLLs, you wont see function parameters or local variables for these functions. Note that MS releases only public symbols for their modules. For local variables or function ...

22. Re:Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

... internal symbols tables. In fact the SDbgExt extension does something similar; it reads MAP files generated by a MS linker and feeds that information to WinDbg. Obviously a MAP file doesn't contain as ...

23. Re:Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... path: "srv*;srv*c:\Symbols*http://msdl.microsoft.com/download/symbols" -> "srv*c:\Symbols*http://msdl.microsoft.com/download/symbols" I don't know if the first srv*; can confuse WinDbg; in any case it ...

24. Remote debugging of CrashMe with ntsd -d
(Forum/Article Discussions)

... -srcpath C:\CrashMe\ I successfull connect to it from windbg with like this : windbg -n -k com:pipe,port=\\.\pipe\com_1,reconnect -srcpath SRV*;C:\CrashMe -y c:\windows\system32;c:\windows\symbols;C:\CrashMe\debug ...

25. StackOverFlowException in .Net
(Forum/Crash Dump Analysis )

... sender, EventArgs e) { MyMethod(); } private void MyMethod() { MyMethod(); } Windbg+sos loads symbols correctly, but with analyze command I've not find references to MyMethod that caused ...

26. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... Dump File: Only registers and stack trace are available Symbol search path is: srv*;srv*c:\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Unable to load image \WINDOWS\system32\ntoskrnl.exe, ...

27. unknown stream type 0x13 and other weird messages
(Forum/Crash Dump Analysis )

... Uptime: 5 days 13:31:23.898 Process Uptime: 3 days 17:16:45.000 Symbol search path is: C:\temp\getDebug;c:\temp\symbols;SRV*c:\temp\symbols*http://msdl.microsoft.com/download/symbols Executable search ...

28. Windbg + Crash Dump
(Forum/Crash Dump Analysis )

... srv*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\WINDOWS\symbols Executable search path is: C:\Symbols\I386 Is it possible to extract information about the routing tables? Is it possible ...

29. windbg question
(Forum/Article Discussions)

Hi, Let's say that the driver I want to debug doesn't have symbols, so I can't use DriverEntry. !lmi 77fba431 (same problem: address not found (so name is interpreted as hex)) Also, the problem ...