1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

Thematically grouped WinDbg command list - keep this on your desk if you use WinDbg! 1) Built-in help commands 9) Exceptions, events, and crash analysis 17) Information about variables 2) ...

2. CrashMe Application
(Applications and Tools/General Applications)

... help for both; your first steps with WinDbg or if you ever need to reproduce a particular crash within a test environment. Take a look at the screen-shot bellow or simply download it to get a hint of what ...

3. !mlocks hung interpretation help needed
(Forum/Crash Dump Analysis )

... of my hunging application? Please help me to interpret this output. Regards, Bernhard ...

4. ASP hang
(Forum/Crash Dump Analysis )

Hi I'd be very grateful for any help with interpreting the following analysis from WinDbg. The problem is an ASP application hanging about once a day. The only solution is to manually recycle the application ...

5. AVIStreamWrite exception.. need help !!
(Forum/User-Mode Debugging)

... occurs. it is properly handled but i could not figure out the reason. I tried to use WindDBG . Sorry i am very new to WINDDBG and infact this is the first case i am trying !!! any help will be really ...

6. Brand New to Windbg - Need some basic answers
(Forum/Kernel-Mode Debugging)

... this doable by using the Windbg debugger? I simply want to set breakpoints at the calls into the bios to trace the register settings, etc. Any help that could be offered would be appreciated. th ...

7. Crash Dump - Analysis Error - Advice Please
(Forum/Crash Dump Analysis )

... Unable to verify timestamp for lvuvc.sys *** ERROR: Module load completed but symbols could not be loaded for lvuvc.sys Any advise to help me resolve the issue and get WinDbg working properly would ...

8. Crash location !
(Forum/Crash Dump Analysis )

... me it should it 017a0000 + 300B = 017a300B? Or do I have to use 0:007> ln 017a200B 012C300B - 0x012C0000 -1000 = 200B? Or am I wrong in my approach itself? Thanks for your help and ...

9. Detail analysis of crashme.exe
(Forum/Article Discussions)

Hi Can you please elaborate how to analyze dump using Crashme.exe it will be very helpful. Regards Sudhir ...

10. Help with crash dump
(Forum/Crash Dump Analysis )

Hi, I am have a regular crash of my machine every 2-3 days. below is the analysis of the problem "Open Crash Dump ...". Can anyone suggest the problem? Is it faulty memory or a driver fault? kd> ...

11. How do source code files help?
(Forum/Debugging of Managed-Code )

I have a little console application throwing an error when trying to open a file. I am certain it's just an issue where the original handle was never closed in a previous function. To try and expose ...

12. How to find parameter values to a method?
(Forum/Debugging of Managed-Code )

... a string as an parameter. But I am not able to identify the value of paramater in !clrstack -p as well.It shows as no data. Please help me out. ...

13. Minidump error
(Forum/Crash Dump Analysis )

Hi, kindly help. Got 3 minidump files w/ after 3 consecutive restart of the machine by itself. Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS:  ...

14. One command for Stack
(Forum/General Questions)

Hello all! I need a command that show me all functions of stack when im debuggin windows with my driver from start until fynal of a breakpoint. can you help me??? ...

15. Other forums
(Forum/General Questions)

Robert, do you have any suggestions for links where I might be able to ask basic questions to help learn about simple items assumed for working with WinDbg? I know many of my questions are really outside ...

16. Prodcuts Info
(Forum/General Questions)

... delicious dinner|recipes will keep you|satisfied and still help you|Combine them with the healthy breakfast|and snack options in this|Easy Dinners Thatll Help You|Lose Weight####31 Oct 2014|Easy Dinners ...

17. Question about COFF deprecation
(Forum/Symbol and Source Files )

... thought a good understanding of PE structure would help with understanding debugging. Does studying a unloaded PE binary help much in the process? Again, my questions might be missing something obvious ...

18. Re: break on driver load - question from kam
(Forum/Article Discussions)

... 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 0: kd> dS ba507cf8 e10e69b8 "\??\C:\CpDrv\77fba431.sys" I hope this helps, Robert ...

19. Re: Crash location !
(Forum/Crash Dump Analysis )

... but it should look something like: cscript adplus.vbs -crash -pn some.exe When you open the dump file, you should see more information and line numbers if you have PDB files, which will help you ...

20. Re: Crashdump bitness
(Forum/General Questions)

... hope this helps, Robert ...

21. Re: Detail analysis of crashme.exe
(Forum/Article Discussions)

Hi Robert, Firstly, thanks for compose this good sample to help us learn more. I'm writing the tutorials for this CrashMe, but I'm having an question which make me cannot go on. Would you mind to give ...

22. Re: Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... Journal Application I hope this helps, Robert ...

23. Re: drwtsn32
(Forum/General Questions)

... /u d:\mydumps\crash.dmp; q" Now ntsd is launched as the default postmortem debugger. It creates a crash dump with a unique name (/u) and exits right thereafter. I hope this helps, Robert ...

24. Re: Finding undocumented swtiches
(Forum/General Questions)

... compiled and linked together into the resulting binary. I hope this helps, Robert ...

25. Re: Finding undocumented swtiches
(Forum/General Questions)

... use the [b]!peb command. It reveals many process related information, among others the command line parameters. I hope this helps, Robert ...

26. Re: function plus offset question
(Forum/Crash Dump Analysis )

Great! Thanks for the help. I have so much trouble sorting through these details in the normal help file / chm. Thanks again! ...

27. Re: hide debugging
(Forum/General Questions)

... data structures. You cannot step through the application though. Check out WinDbg. From A to Z! - "Invasive vs. Noninvasive Debugging and Attaching" at slide 16 I hope this helps, Robert ...

28. Re: Is it possible to view Mutant states from a Cr
(Forum/User-Mode Debugging)

Yes, it is indeed possible. The problem I had was that I was using an old version of DBGHELP.DLL. As long as 6.6.x.x or above is used, the Mutant info will be available. (SOLVED) ...

29. Re: kernel32 symbol in live kernel debug
(Forum/Symbol and Source Files )

... this helps, Robert ...

30. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... has index 0x25 on Windows XP SP3 it might have the value 0x34 on Vista. Fortunately we can easily obtain the correct value by examining ntdll.dll... I hope this helps, Robert ...

31. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

Thanks for the help! I learned a bit about SYSENTER and was using... rdmsr 176 bp /t @$thread addr ...as a one-shot break point on going into the Kernel, but I will have to give your bp script a ...

32. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... Processes and Threads Process Address Space I hope this helps, Robert ...

33. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

Thanks again for you help, I fully understand it now! ...

34. Re: One command for Stack
(Forum/General Questions)

Hi Victor, check the 15) Call stack commands in our "Common WinDbg Commands" list. For instance, you might try "kn", "kb".. I hope this helps, Robert ...

35. Re: Pattern matching
(Forum/Article Discussions)

... is going on by the "al" (alias list) or "bl" (breakpoint list) commands. If you see some unusual values the following will help: a) "ad *" == deletes all aliases b) Reset the breakpoint in question I'll ...

36. Re: Remote debugging of CrashMe with ntsd -d
(Forum/Article Discussions)

... with WinDbg" at slide 87. Basically you have to copy dbgsrv.exe, dbgeng.dll and dbghelp.dll to the remote machine, run dbgsrv.exe on a given port, and connect to that port with WinDbg. The additional trick ...

37. Re: See in Memory Descriptor List whats on
(Forum/Kernel-Mode Debugging)

...  b9f836a6 8a7c0130 0x00000030 AcpR b9f877c9 .... I hope this helps, Robert ...

38. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

... /mf c:mydump.dmp). I hope this helps, Robert ...

39. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

... The sorted output from your script will then be displayed in WinDbg's Command window. I hope this helps, Robert ...

40. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

... this helps, Robert ...

41. Re: Symbol not found
(Forum/Symbol and Source Files )

common people just any one try to help>>> by the way when we specify the symbol path why we have to add the "srv*" before the debug file path ? ...

42. Re: Symbol not found
(Forum/Symbol and Source Files )

... at Common WinDbg Commands (Thematically Grouped) I hope this helps, Robert ...

43. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... is looking in the correct directory and the symbol is in the directory, the dump still fails. Here's a log file example: DBGHELP: new session: Fri May 07 12:17:47 2010 DBGHELP: _NT_SYMBOL_PATH: E:\WindowsKernelDump\Symbols DBGHELP: ...

44. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... You target computer being debugged doesn't need to be online. I hope this helps, Robert ...

45. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... for your help and letting me bounce this off of here. Kind Regards, Chris ...

46. Re: windbg question from kam
(Forum/Article Discussions)

... this: > bp BaseAddress (retrieved in previous step) + rva_entrypoint I hope this helps, Robert ...

47. Re: Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

... show you and will show you the same symbol information as IDA does. I hope this helps, Robert ...

48. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

... parameters one would need private PDB symbols. Again welcome to read more on symbols at WinDbg. From A to Z!, slides 11-14. I hope this helps. Warm Regards, RK PS: Oh, there is one more candy ...

49. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

Thanks Robert. You've given me a lot to work with. I am still in the "wide-eyed" stage of figuring out very basics. These things help me get a grasp much more quickly. ...

50. Re:Can handled exceptions be seen with WinDbg
(Forum/Debugging of Managed-Code )

... command. I hope this helps, RK :) ...