1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

... octal, binary, time, ..) Example 1: .formats 5 Example 2: .formats poi(nLocal1) == .formats @@($!nLocal1) .cls Clear screen .lastevent ...

2. Contact & Imprint
(Misc/Legal)

... of hosting fees for the time an infringement was online after detection. Decisive is the tax-free charge at the origin of the claims. This liability disclaimer is to be considered as ...

3. Who Visits Us?
(Misc/Misc)

... much as we do creating it. But serious, if you do work for Microsoft and you are reading this now consider asking your department leader about a little donation. This way we could spend even more time ...

4. WinDbg. From A to Z!
(Documents/Presentations)

... WinDbg's documentation (which is also great, although much more extensive) and learn assembly (simply essential if you want to solve a variety of problems). If you never took the time for advanced debugging ...

5. !heap failed in windbg. Invalid type information f
(Forum/Crash Dump Analysis )

... (4 procs) Free x86 compatible Product: Server, suite: TerminalServer SingleUserTS kernel32.dll version: 5.2.3790.4480 (srv03_sp2_gdr.090321-1244) Machine Name: Debug session time: Wed Mar 16 16:36:10.000 ...

6. ASP hang
(Forum/Crash Dump Analysis )

... pool. The server is Windows 2003 and IIS6. Many thanks in advance. Here's the output: 0:000:x86> !analyze -v *** WARNING: symbols timestamp is wrong 0x499007dc 0x49900d5a for ntdll.dll ******************************************************************************* * ...

7. AVIStreamWrite exception.. need help !!
(Forum/User-Mode Debugging)

I got one excpetion when trying to create AVI file using AVIstreamWrite API. Normally it works fine but i have one another thread sometimes working in parallel to this thread and at that time some exception ...

8. Brand New to Windbg - Need some basic answers
(Forum/Kernel-Mode Debugging)

... 'Shutdown' command is issued in Win 2000. This has bugged me for some time. I'm sure that my bios has some incompatibility with the NTapm.sys/HAL.dll calls and want to see if I can track it down. Is ...

9. Bugcheck Analysis
(Forum/Crash Dump Analysis )

... session time: Sat Jun 5 10:17:58.751 2010 (GMT+2) System Uptime: 0 days 0:10:32.533 Loading Kernel Symbols .........................................................................................Missing ...

10. Crash Dump - Analysis Error - Advice Please
(Forum/Crash Dump Analysis )

... Unable to verify timestamp for lvuvc.sys *** ERROR: Module load completed but symbols could not be loaded for lvuvc.sys Any advise to help me resolve the issue and get WinDbg working properly would ...

11. Help with crash dump
(Forum/Crash Dump Analysis )

...  mov esi,[eax+0x140] SYMBOL_STACK_INDEX: 0 FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: nt!PsReturnProcessNonPagedPoolQuota+19 MODULE_NAME: nt IMAGE_NAME: ntoskrnl.exe DEBUG_FLR_IMAGE_TIMESTAMP: ...

12. How to disable FPO optimisation on x64 VC++ compil
(Forum/General Questions)

... am wondering if this flag is only available for x86, then how come the x64 windows routines like FileTimeToSystemTime has FPO disabled! 0:000> uf . KERNELBASE!FileTimeToSystemTime: 00007ffc`a03ad120 ...

13. Is it possible to view Mutant states from a Crash
(Forum/User-Mode Debugging)

... crash dump file so that I can exame the mutex states at the time that I invoke the crash dump. I've tried creating a crashdump using PROCDUMP -ma test.exe. Can somebody please tell me if and how it ...

14. Its the best
(Forum/Article Discussions)

I was looking for Windbg tutorial from long time and with all that scattered information I was more confused. Thanks a lot for this wonderful presentation. Cheers! Shambhu ...

15. Memory Searching issue (command s)
(Forum/Kernel-Mode Debugging)

... The problem I am having is, the images I debug are large (often 5-10mb), and they seem to get paged out all the time, making searching impossible. If I didn't know the exact address of where to find my ...

16. Minidump error
(Forum/Crash Dump Analysis )

...  kb FOLLOWUP_IP: hknlgi+2b3 f3a552b3 ?? ??? SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: hknlgi+2b3 FOLLOWUP_NAME: MachineOwner MODULE_NAME: hknlgi IMAGE_NAME: hknlgi.sys DEBUG_FLR_IMAGE_TIMESTAMP: ...

17. Pattern matching
(Forum/Article Discussions)

... staring at it for quite some time but I can't figure out where I'm doing wrong. ...

18. Random Thread getting stuck
(Forum/User-Mode Debugging)

I've spent the last couple of weeks investigating a very very difficult bug. Firstly some background... our application prcoesses 600-1000 pairs of audio streams from the network in realtime and uses ...

19. Re: break on driver load - question from kam
(Forum/Article Discussions)

... memory (be it an EXE, DLL, or kernel mode driver) and calls its entry point thereafter. In other words by the time DriverEntry is called the driver will always be loaded. If all you need is break into ...

20. Re: Crashdump bitness
(Forum/General Questions)

Welcome Nachiket. You can actually open a 32-bit dump with both a 32- or 64-bit WinDbg. At the same time you can open a 64-bit dump with both variants of WinDbg too. So, how to find out the bitness ...

21. Re: function plus offset question
(Forum/Crash Dump Analysis )

And you're talking bytes as in the function + number of bytes of compiled code at runtime/debugging, not number of bytes of src correct? Thanks. ...

22. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... that at any time there is only one active user-mode process. A kernel-mode debugger will only see user-mode addresses of this one process. To peek into another process's memory you have to switch the context ...

23. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

Welcome Carl. You might try the !dll -l command. It lists all currently loaded dlls sorted by their load order, though enough memory information must be present in the dump for the command to work (.dump ...

24. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

my objective is to sort the list by creation date-time to spot drivers which are woefully out-of-date. ...

25. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

Oh, I see..my mistake. I guess the easiest way is to redirect the output of "lm n t" to an external PowerShell or Perl or VB script and sort it out there. For example: .shell -ci "lm n t" perl.exe parsemyoutput.pl. ...

26. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

will not accomplish my objective. Remember that just sort by module, one merely adds sm.

27. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

... lines(0), timeStamps(0) c = 0 Do While Not StdIn.AtEndOfStream ReDim Preserve lines(UBound(lines) + 1) ReDim Preserve timeStamps(UBound(timeStamps) + 1) str = StdIn.ReadLine lines(c) ...

28. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

Robert, I apologize for not getting back. I did some reading and wrote a PowerShell script to sort the list and perform a couple of other clean up operations. Thanks, karl

29. Re: Symbol not found
(Forum/Symbol and Source Files )

... check: - that there is indeed a PDB file that is generated alongside your exe (both should have same timestamps) - your compiler settings - debug information: /Zi (Program Database) should be set, ...

30. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

Chris, you are welcome. I hope you applied correct symbols to all your environments in the meantime. I didn't try it but I guess you ended up with two different symbol sets for Windows Server 2003 ...

31. Re:Articles/tutorials
(Forum/Suggestion Box)

... so anyone could make contributions there. In the meantime just let me know if you have something really interesting to write on and we will figure out something. Kind regards, Robert ...

32. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

... again This time WinDbg is attached right after ntdll.dll has been loaded into our newly created address space. Now you can debug the windows loader which is actually implemented in large part in ntdll.dll. Note ...

33. Re:Can handled exceptions be seen with WinDbg
(Forum/Debugging of Managed-Code )

Hi Will, here I go again. Sorry for the little delay this time. Can handled exceptions be seen with WinDbg Short answer: Nope. A handled/dismissed exception isn't an exception anymore. Long answer: ...

34. Re:Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

... that GNU tools them self would be able to emit PDBs any time soon. On the other side it should be much easier to make a WinDbg extension which reads the GNU debug information and feeds it to WinDbg's ...

35. Re:Question about COFF deprecation
(Forum/Symbol and Source Files )

... over all these years. The most obvious reason is backward compatibility. Say, if Windows 7 wants to execute an EXE written at Windows 98 times the PE format should be the same. Sure, Microsoft added a ...

36. sort lm n t by date/time
(Forum/Crash Dump Analysis )

When analyzing a minidump, how do I sort the output of lm n t by date-time? ...

37. Symbol not found
(Forum/Symbol and Source Files )

... is a symbol code that have a run-time protected access memory error : #include void main() { //point to location 0 int *ptr1; printf("Hello World\n"); //read from Location 0 (Protected ...

38. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows XP Kernel Version 2600 (Service Pack ...

39. unknown stream type 0x13 and other weird messages
(Forum/Crash Dump Analysis )

I have several dumps on a system that always shows the following messages logged. Does anyone know what this indicates (in bold): Loading Dump File [C:\temp\dumps\Crash_Mode__Date_09-03-2010__Time_12-37-50PM\PID-5396__VWJS.EXE__1st_chance_Process_Shut_Down__full_24e4_2010-09-07_05-27-12-493_1514.dmp] User ...

40. Warmest Welcome to Our Visitors
(Forum/News and Announcements)

Warmest Welcome to Our Visitors After I spent quite some time to integrate a Forum solution into our site, I'm happy to announce that it is finally done. I hope the Forum will serve well for all ...

41. WinDbg !threads for ASP.NET 4 memory dump
(Forum/Debugging of Managed-Code )

!ASPXPages from psscor4 doesn't display threadID's for threads that are queued or completed. However !threads seems to show a threadID all the time. Does it include threads that are queued? idle in the ...

42. WinDbg showing Wrong Info
(Forum/User-Mode Debugging)

I've got a program that I'm trying to debug but when I attach WinDbg to the process and look at the call stack for the thread that I'm interested in I sometimes see that the 'this' pointer is NULL, or ...