1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

...  21) Application Verifier 6) Main extensions 14) Tracing and stepping (F10, F11) 22) Logging extension (logexts.dll) 7) Symbols 15) Call stack 8) Sources ...

2. WinDbg. From A to Z!
(Documents/Presentations)

...  Commands on threads and locks (31, 55) Memory: Stack details (37, 39, 41) Memory: General commands (43) Memory: Heap commands and examples (45, 49, 51, 53) Useful commands for ...

3. ASP hang
(Forum/Crash Dump Analysis )

... 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 0 FAULTING_THREAD: 00000000000068c8 DEFAULT_BUCKET_ID: ZEROED_STACK PROCESS_NAME: w3wp.exe OVERLAPPED_MODULE: ...

4. Bugcheck Analysis
(Forum/Crash Dump Analysis )

... Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel ...

5. Crash location !
(Forum/Crash Dump Analysis )

... EIP=012C300B FLG=00010206 CS =001B DS =0023 SS =0023 ES =0023 FS =003B GS =0000 Call Stack: 001B:012C300B (0x00910048 0x009AE718 0x009AE6E0 0x009AE6EC) some.dll 001B:01A11027 ...

6. function plus offset question
(Forum/Crash Dump Analysis )

Hi, when I'm looking at a threads call stack what do the numbers after the function mean? As indicated below as libxx!classxx::Perform+0x4fe and libxx!classxx::Perform+0x60c what are the +0x4fe ...

7. Minidump error
(Forum/Crash Dump Analysis )

...  cmp dword ptr [esi+8],eax ds:0023:fffffff0=???????? Resetting default scope LAST_CONTROL_TRANSFER: from e085eced to e0827c63 STACK_TEXT: eeb9dba0 e085eced 00000050 fffffff0 00000000 ...

8. Re: Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... mode. The stack in the kernel looks something like this: 1: kd> kb ChildEBP RetAddr Args to Child acb11adc b9dbdca6 88928a38 88666008 acb11b20 Ntfs!NtfsDeleteUsnJournal acb11af0 b9da7adc 88928a38 ...

9. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... is accomplished trough an opcode called sysenter/sysexecute (Intel/AMD). You can see this if you debug a few steps into kernel32!CreateFileW. The call stack will then look like this: 0:000> k ChildEBP ...

10. Re:How do source code files help?
(Forum/Debugging of Managed-Code )

... stacks with functions names, source code information, and so on in almost the same way as you see it for C++ applications. To keep it short: You can use WinDbg to obtain some extra information for ...

11. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... Dump File: Only registers and stack trace are available Symbol search path is: srv*;srv*c:\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Unable to load image \WINDOWS\system32\ntoskrnl.exe, ...

12. windbg question
(Forum/Article Discussions)

... to be already loaded, right? so why would I set a bp on entry point then... The only method that works that I've found so far, is "bp" on a driver with symbols, walking up the stack and find the address ...