1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

Thematically grouped WinDbg command list - keep this on your desk if you use WinDbg! 1) Built-in help commands 9) Exceptions, events, and crash analysis 17) Information about variables 2) ...

2. Contact & Imprint
(Misc/Legal)

Responsible for the online presence Robert Kuster Slovenia E-mail: mailrkuster@windbg.info   Note: The actual email address does not contain the word “mail“ – spam prevention.   ...

3. CrashMe Application
(Applications and Tools/General Applications)

... help for both; your first steps with WinDbg or if you ever need to reproduce a particular crash within a test environment. Take a look at the screen-shot bellow or simply download it to get a hint of what ...

4. Who Visits Us?
(Misc/Misc)

... very nice", we answer. "But imagine how nice it would be if we could make some money out of it too", we add right thereafter.   Welcome to www.windbg.info. We hope you enjoy browsing our site as ...

5. WinDbg. From A to Z!
(Documents/Presentations)

Quick start and introduction to WinDbg. 111 slides with examples. Foreword by Wanderley Caloni All the power and flexibility of the Microsoft Debugging Tools package can be diminished by its complexity ...

6. !heap failed in windbg. Invalid type information f
(Forum/Crash Dump Analysis )

... Server 2003 SP2 x64 machine. From the following windbg log I see that loaded ntdll.dll image is incorrect and does not correspond to ntdll.pdb symbols. I have tried to specify the location to ntdll.dll ...

7. !mlocks hung interpretation help needed
(Forum/Crash Dump Analysis )

Hi, i try to investigate a hung with windbg. If I call the command !mlocks i got the following :000> !mlocks Examining SyncBlocks... Scanning for ReaderWriterLock instances... Scanning for holders ...

8. ASP hang
(Forum/Crash Dump Analysis )

Hi I'd be very grateful for any help with interpreting the following analysis from WinDbg. The problem is an ASP application hanging about once a day. The only solution is to manually recycle the application ...

9. AVIStreamWrite exception.. need help !!
(Forum/User-Mode Debugging)

... appreciated. Exception in WinDBG ---------------------------- ModLoad: 73b50000 73b67000 C:\WINDOWS\system32\AVIFIL32.dll ModLoad: 75a70000 75a91000 C:\WINDOWS\system32\MSVFW32.dll ModLoad: ...

10. Brand New to Windbg - Need some basic answers
(Forum/Kernel-Mode Debugging)

Hi.. Just joined and am very new to Windbg.. I have a simple need and that is to monitor the calls made from NTapm.sys into my system bios. I own a logic analyzer that runs off of Windows 2000 and ...

11. Can all commands be watched with WinDbg
(Forum/General Questions)

This is a very basic question. I have not been able to figure out the answer and I have been curious about this for a while. If I open an executable from WinDbg, is there a way to watch every single action ...

12. Can handled exceptions be seen with WinDbg
(Forum/Debugging of Managed-Code )

... WinDbg with the SOS extension? Conversely, are only unhandled exceptions caught by WinDbg? I saw she used the sxe command and thought it might be similar. ...

13. Can macros be set up in WinDbg
(Forum/General Questions)

If I want to perform a common task, for instance, load a specific set of assemblies easily with a hotkey, is there a way to do anything along those lines in WinDbg? I am aware of aliases, but, wanted ...

14. Common WinDbg Commands (Thematically Grouped)
(Forum/Article Discussions)

** This thread discusses the content article: Common WinDbg Commands (Thematically Grouped) ** ...

15. Crash Dump - Analysis Error - Advice Please
(Forum/Crash Dump Analysis )

WinDbug Error – Advice Please I created a folder for Symbols located as below: C:\Windows In WinDbg I set a symbol path as below: SRV*C:\Windows\Symbols*http://msdl.microsoft.com/download/symbols/packages/WindowsVista/WindowsVista.6002.090410-1830.x86fre.Symbols.exe When ...

16. Crash location !
(Forum/Crash Dump Analysis )

... (0x074CA008 0x05CBFA38 0x05CBFE34 0x00000000) seven.dll ================================================================================ I started winDBG and attached it to the instance of the faulty ...

17. Creating custom disassembly-like window in an ext
(Forum/Writting Extensions)

I'm trying to figure out if creating custom windows via the Windbg extension APIs is possible. So far I've skimmed the extension sections in the manual and looked at the sample extension in the windbg ...

18. Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

... names - no file debug info. How about in winDBG? It surprises me that VS can't absorb C code PE/COFF/STABS debug info and that there is no COFF to PDB conversion tool. ...

19. Debugging Printer Driver using WinDbg.
(Forum/General Questions)

Hello All, I have to develop printer driver. For the same I am using the already developed samples provided by WDK. Now the question is how can I debug those driver with one of my printer. My printer ...

20. Debugging TDRs
(Forum/General Questions)

... to verify if the driver resets in a good-know way after the TDR is presented. When i generate the TDR with no Windbg connected, i can see the whole proccess going on, and when it is supposed to restart, ...

21. Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... with error code 1. As I suspected, system privileges did not allow me to delete the entries. So, I am looking to use WinDbg to figure out what process or system structure is preventing the utility from ...

22. Developing WinDBG extensions in Visual Studio
(Forum/Writting Extensions)

Hello everyone, I would like to share with everyone the following link which I found via google. http://www.saygoodnight.com/?p=48 So... if you are trying to code a WinDBG extension in VS, don't ...

23. Dll export table - Exported functions list and @
(Forum/Kernel-Mode Debugging)

Hello Can we extract exported functions list from a dll and their asociated addresses using windbg? Can we determine what dlls's functions are used by an application? for exemple: myapp.exe ...

24. Function offsets and return address in callstack
(Forum/User-Mode Debugging)

... 00c11465 ? Is this always rule when inspecting callstack information for a thread in windbg (assuming callstack information is valid and also correct symbols are loaded)? An example of this would be very ...

25. Great!
(Forum/Article Discussions)

A very compressive and clear guide to Windbg. Thanks !!!!!!! :) ...

26. Heap Debugging Windows 7
(Forum/General Questions)

hello there .. Here anybody tried to examine (using Windbg) , how heap manager allocates heap memory ?? ...

27. hide debugging
(Forum/General Questions)

Hi. Is it possible to use !hidedbg in windbg. I would like to hide debugging from the process. Since windbg adds 16bytes to heap blocks for it's own usage (don't know why), I would like to hide it, so ...

28. How do source code files help?
(Forum/Debugging of Managed-Code )

... myself to more WinDbg I loaded up the 2.0 SOS dll and started hitting away at it. I actually made some progress an have a few indicators as to what the exact error is, but, would like to cross-reference ...

29. How to disable FPO optimisation on x64 VC++ compil
(Forum/General Questions)

Hi, Recently I started using Windbg(x64), To play with it, I have compiled(x64) a sample program using cl.exe ls.c /Zi /Od /GS- Interestingly the functions generated for the executable contain ...

30. How to find parameter values to a method?
(Forum/Debugging of Managed-Code )

Hi all, I faced an .net exception in my application in the customer machine. Without closing the exception I attached Windbg and I saw the clrstack. The method in which exception has occurred accepts ...

31. Is it possible to view Mutant states from a Crash
(Forum/User-Mode Debugging)

Hi. I have a simple application that holds a Mutex (Mutant) object. If I attach to the process with WinDbg and enter: 0:001> !handle 0 f Mutant Handle 7f4 Type Mutant Attributes  ...

32. Its the best
(Forum/Article Discussions)

I was looking for Windbg tutorial from long time and with all that scattered information I was more confused. Thanks a lot for this wonderful presentation. Cheers! Shambhu ...

33. Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

Hello, I am new to WinDbg, but not debugging in general. I am trying to step through certain calls like CreateFileA to see how they work, and I get to an area where it looks like the screenshot below: http://j.imagehost.org/0320/windbg1.png I ...

34. ntdll.dll symbols are missing?
(Forum/Symbol and Source Files )

Hi all. I have a problem with ntdll.dll symbols. Actually, I just have no .pdb files for it, however all of pdb's are downloaded from microsoft site (I use symbol server for windbg, actually). And when ...

35. Other forums
(Forum/General Questions)

Robert, do you have any suggestions for links where I might be able to ask basic questions to help learn about simple items assumed for working with WinDbg? I know many of my questions are really outside ...

36. Parsing SYSTEM_PROCESS_INFORMATION!
(Forum/Kernel-Mode Debugging)

... Windbg! Any idea how to do that? Is it possible ? Thanks !! ...

37. Question about COFF deprecation
(Forum/Symbol and Source Files )

On page 11 of WinDbg_A_to_Z you mentioned that "COFF and CodeView are considered deprecated." As someone new to studying debugging and binary file structures, would there be something new to study? I ...

38. Random Thread getting stuck
(Forum/User-Mode Debugging)

... so Audio Receiving threads) just stops. It doesn't exit but its not running either! Using WinDbg I can see the following call stack for the stuck thread: ntdll!NtWaitForMultipleObjects+0x15 (FPO: ...

39. Re: break on driver load - question from kam
(Forum/Article Discussions)

... WinDbg after a driver is loaded but before its entry point is called the situation is simple. And if you want to break even before the image is loaded into memory the situation is still simple enough. ...

40. Re: Can handled exceptions be seen with WinDbg
(Forum/Debugging of Managed-Code )

More about....Exception HandlingException Handling Dov

41. Re: Crashdump bitness
(Forum/General Questions)

Welcome Nachiket. You can actually open a 32-bit dump with both a 32- or 64-bit WinDbg. At the same time you can open a 64-bit dump with both variants of WinDbg too. So, how to find out the bitness ...

42. Re: CrashMe Application
(Forum/Article Discussions)

My development machine is Win2000sp4. My development environment is VC6sp6. Does anyone have a version of CrashMe for VC6? Your article "WinDbg From A to Z" is very inspiring! ...

43. Re: CrashMe Application
(Forum/Article Discussions)

Hello everybody I can't see 10 Mb memory in dump which allocate operator new. I do next step 1) Start "CrashMe.exe" in debug mode 2) Attach with WinDbg 3) Press button "operator new*" 4) Press ...

44. Re: Detail analysis of crashme.exe
(Forum/Article Discussions)

Sudhir, welcome and thanks for your input. In fact an article about setting up WinDbg and analyze CrashMe and its crash dumps is the very next thing I will do over the next weeks. I hope to see ...

45. Re: Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... "\\.\c:", OR "\\.\d:", OR.. kernel32!DeviceIoControl(hVolume, FSCTL_DELETE_USN_JOURNAL, ..) fsutil!DisplayError(..) } In short you can attach WinDbg to fsutil.exe, set a breakpoint on DeleteUsnJournal, ...

46. Re: drwtsn32
(Forum/General Questions)

... on my XP machines. My suggestion is that you simply use ntsd.exe or WinDbg.exe in order to generate the crash dumps - if it is your own application and test environment, it doesn't make sense to send the ...

47. Re: Finding undocumented swtiches
(Forum/General Questions)

Oh, you mean command line parameters. If you use Process Explorer you could simply click on the process in question and go to the Image tab. For example: [USER POSTED IMAGE] And in WinDbg you could ...

48. Re: Finding undocumented swtiches
(Forum/General Questions)

... have found found what code section I need to check out in the PE or in something like Windbg or Ollydbg to see the switches used to compare against when arguments are passed to the .exe. ...

49. Re: hide debugging
(Forum/General Questions)

Welcome Eleanor, I'm afraid not. The best you can do is attach WinDbg noninvasively. With noninvasive debugging the target applications gets frozen and WinDbg is able to read and examine memory and various ...

50. Re: kernel32 symbol in live kernel debug
(Forum/Symbol and Source Files )

... principle and is simply not needed to debug an application or the kernel. You can still check out the Symbol Options for WinDbg or start your investigation by examining the ld or !lmi commands. I hope ...