1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

Thematically grouped WinDbg command list - keep this on your desk if you use WinDbg! 1) Built-in help commands 9) Exceptions, events, and crash analysis 17) Information about variables ...

2. Contact & Imprint
(Misc/Legal)

Responsible for the online presence Robert Kuster Slovenia E-mail: mailrkuster@windbg.info   Note: The actual email address does not contain the word “mail“ – spam prevention.   ...

3. CrashMe Application
(Applications and Tools/General Applications)

... help for both; your first steps with WinDbg or if you ever need to reproduce a particular crash within a test environment. Take a look at the screen-shot bellow or simply download it to get a hint of what ...

4. Who Visits Us?
(Misc/Misc)

... very nice", we answer. "But imagine how nice it would be if we could make some money out of it too", we add right thereafter.   Welcome to www.windbg.info. We hope you enjoy browsing our site as ...

5. WinDbg. From A to Z!
(Documents/Presentations)

Quick start and introduction to WinDbg. 111 slides with examples. Foreword by Wanderley Caloni All the power and flexibility of the Microsoft Debugging Tools package can be diminished by its complexity ...

6. ASP hang
(Forum/Crash Dump Analysis )

Hi I'd be very grateful for any help with interpreting the following analysis from WinDbg. The problem is an ASP application hanging about once a day. The only solution is to manually recycle the application ...

7. Can all commands be watched with WinDbg
(Forum/General Questions)

This is a very basic question. I have not been able to figure out the answer and I have been curious about this for a while. If I open an executable from WinDbg, is there a way to watch every single action ...

8. Can handled exceptions be seen with WinDbg
(Forum/Debugging of Managed-Code )

... WinDbg with the SOS extension? Conversely, are only unhandled exceptions caught by WinDbg? I saw she used the sxe command and thought it might be similar. ...

9. Can macros be set up in WinDbg
(Forum/General Questions)

If I want to perform a common task, for instance, load a specific set of assemblies easily with a hotkey, is there a way to do anything along those lines in WinDbg? I am aware of aliases, but, wanted ...

10. Common WinDbg Commands (Thematically Grouped)
(Forum/Article Discussions)

** This thread discusses the content article: Common WinDbg Commands (Thematically Grouped) ** ...

11. Crash location !
(Forum/Crash Dump Analysis )

... (0x074CA008 0x05CBFA38 0x05CBFE34 0x00000000) seven.dll ================================================================================ I started winDBG and attached it to the instance of the faulty ...

12. Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

... names - no file debug info. How about in winDBG? It surprises me that VS can't absorb C code PE/COFF/STABS debug info and that there is no COFF to PDB conversion tool. ...

13. Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... with error code 1. As I suspected, system privileges did not allow me to delete the entries. So, I am looking to use WinDbg to figure out what process or system structure is preventing the utility from ...

14. Developing WinDBG extensions in Visual Studio
(Forum/Writting Extensions)

Hello everyone, I would like to share with everyone the following link which I found via google. http://www.saygoodnight.com/?p=48 So... if you are trying to code a WinDBG extension in VS, don't ...

15. Great!
(Forum/Article Discussions)

A very compressive and clear guide to Windbg. Thanks !!!!!!! :) ...

16. How do source code files help?
(Forum/Debugging of Managed-Code )

... myself to more WinDbg I loaded up the 2.0 SOS dll and started hitting away at it. I actually made some progress an have a few indicators as to what the exact error is, but, would like to cross-reference ...

17. Its the best
(Forum/Article Discussions)

I was looking for Windbg tutorial from long time and with all that scattered information I was more confused. Thanks a lot for this wonderful presentation. Cheers! Shambhu ...

18. Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

Hello, I am new to WinDbg, but not debugging in general. I am trying to step through certain calls like CreateFileA to see how they work, and I get to an area where it looks like the screenshot below: http://j.imagehost.org/0320/windbg1.png I ...

19. Other forums
(Forum/General Questions)

Robert, do you have any suggestions for links where I might be able to ask basic questions to help learn about simple items assumed for working with WinDbg? I know many of my questions are really outside ...

20. Question about COFF deprecation
(Forum/Symbol and Source Files )

On page 11 of WinDbg_A_to_Z you mentioned that "COFF and CodeView are considered deprecated." As someone new to studying debugging and binary file structures, would there be something new to study? I ...

21. Re: break on driver load - question from kam
(Forum/Article Discussions)

... WinDbg after a driver is loaded but before its entry point is called the situation is simple. And if you want to break even before the image is loaded into memory the situation is still simple enough. ...

22. Re: Detail analysis of crashme.exe
(Forum/Article Discussions)

Sudhir, welcome and thanks for your input. In fact an article about setting up WinDbg and analyze CrashMe and its crash dumps is the very next thing I will do over the next weeks. I hope to see ...

23. Re: Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... "\\.\c:", OR "\\.\d:", OR.. kernel32!DeviceIoControl(hVolume, FSCTL_DELETE_USN_JOURNAL, ..) fsutil!DisplayError(..) } In short you can attach WinDbg to fsutil.exe, set a breakpoint on DeleteUsnJournal, ...

24. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... execution to kernel-mode. Unfortunately we cannot debug this transition from WinDbg directly so there is a little bit more to know about system services and their implementation on Windows. If we take ...

25. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

Brett, hi again. The following excerpt of the .process (Set Process Context) command explains it quite well. You might also take a look at .context (Set User-Mode Address Context) which is a very similar ...

26. Re: Pattern matching
(Forum/Article Discussions)

Hey hey Adrian, Thanks for your feedback. I encountered similar problems with this breakpoint command. It turns out that here and then the aliases get messed up by WinDbg. You can easily check what ...

27. Re: See in Memory Descriptor List whats on
(Forum/Kernel-Mode Debugging)

... including Windows Vista. On these systems, the Enable pool tagging check box on the Global Flags dialog box is dimmed and commands to enable or disable pool tagging fail.". Also alongside your WinDbg installation ...

28. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... server. Hm, do you want to create a dump or do you need live kernel-debugging? For if you just need a DUMP you don't need any symbols. You simply create a DUMP which you then investigate with WinDbg ...

29. Re: windbg question from kam
(Forum/Article Discussions)

Kam, hi. Let's assume that the entry point of your driver is called DriverEntry. In this case setting a breakpoint is simple: > bp 77fba431!DriverEntry And if you prefer to work with offsets you ...

30. Re: Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

... More precisely WinDbg will fetch the correct symbols automatically for you from the server, if you set it up correctly. You might read WinDbg. From A to Z! - "Symbols in WinDbg" at slide 24. Or simply ...

31. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

Hi Will, yes it can be done with WinDbg. Let's start with the File->Open Executable from WinDbg's menu; this way WinDbg starts your application and actually stops after several system DLLs (for example ...

32. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

Thanks Robert. You've given me a lot to work with. I am still in the "wide-eyed" stage of figuring out very basics. These things help me get a grasp much more quickly.

33. Re:Can handled exceptions be seen with WinDbg
(Forum/Debugging of Managed-Code )

Hi Will, here I go again. Sorry for the little delay this time. Can handled exceptions be seen with WinDbg Short answer: Nope. A handled/dismissed exception isn't an exception anymore. Long answer: ...

34. Re:Can macros be set up in WinDbg
(Forum/General Questions)

Hi Will, welcome. Short answer: Yes. Long answer: WinDbg offers a quite powerful mechanism called "Debugger Commands Programs". In fact this is a simple script-language where you can use all commands ...

35. Re:Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

... that GNU tools them self would be able to emit PDBs any time soon. On the other side it should be much easier to make a WinDbg extension which reads the GNU debug information and feeds it to WinDbg's ...

36. Re:How do source code files help?
(Forum/Debugging of Managed-Code )

Hi Will, we are somewhat out of luck here, I'm afraid. By default WinDbg doesn't support debugging of managed code natively - at least not in its public releases. See explanation here: No CLR support ...

37. Re:Other forums
(Forum/General Questions)

Hi Will, From my point of view your questions perfectly fit to the forum; that is what it actually is about. Help people with WinDbg, regardless to what their initial skills might be. Hm, if you nevertheless ...

38. Re:Question about COFF deprecation
(Forum/Symbol and Source Files )

Hi Will, first of all I wish you a happy and prosper 2010. May there be lot of www.windbg.info visits and forum posts. As to your questions, there are two things to distinguish: 1) Portable Executable ...

39. Re:RSS Feed
(Forum/Suggestion Box)

Hey Will, thanks for this input. In fact there is a simple RSS feed already. See the little reddish icon in the lower right corner? Its link is: http://windbg.info/forum/fb_rss.html?no_html=1 But ...

40. Re:Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

Will, Hi. Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2 For some reason WinDbg doesn't find the associated ntoskrnl.exe image. You usually need both for Crash Dumps: a) The ...

41. Re:Using WinDbg to examine ASP.NET applications
(Forum/Debugging of Managed-Code )

Will, Hi. The worker process for ASP.NET applications is aspnet_wp.exe which internally heavily relies on mscorwks.dll. TODOs: For instance you could use the following WinDbg commands after a ...

42. Re:Using WinDbg to examine ASP.NET applications
(Forum/Debugging of Managed-Code )

Awesome. Thanks for the pointers and the link to the PDF. I had not even seen that one yet. Looking forward to working with it. Again, much appreciated.

43. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

I want to be sure I have WinDbg configured properly. I've got a minidump that returns this error when I load it: Loading Dump File [C:\Documents and Settings\will\Desktop\Mini021610-02.dmp] Mini Kernel ...

44. Using WinDbg to examine ASP.NET applications
(Forum/Debugging of Managed-Code )

... where (and how much) data is cached? I just need a starting point to look at this from the WinDbg side of things. Once I get an idea of how to get into the relevant process I can go from there. I tried ...

45. Warmest Welcome to Our Visitors
(Forum/News and Announcements)

... Your WinDbg related questions and needs. And I do thank You for any future contributions and posts to the Forum or to www.windbg.info itself. ...

46. WinDbg A-Z is Wonderful!
(Forum/Article Discussions)

Hi, Just thought I'd tell you how much I love that article. I'm still reading it, but even from the first few dozen pages I've learned so much that I missed when reading over the dry official reference ...

47. windbg question
(Forum/Article Discussions)

Hi, This article is very nice, I'm a beginner to windbg and this is helping me a lot. Also, I have a question: Could you tell me please, how do I set a bp on a driver entrypoint if driver name is hex ...

48. windbg question
(Forum/Article Discussions)

Hi, Let's say that the driver I want to debug doesn't have symbols, so I can't use DriverEntry. !lmi 77fba431 (same problem: address not found (so name is interpreted as hex)) Also, the problem ...

49. WinDbg. From A to Z!
(Forum/Article Discussions)

** This thread discusses the content article: WinDbg. From A to Z! ** ...

50. Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

I'm debugging an application for which I have no source. The app is crashing in a dll. In IDA pro I see: call ds:__imp_strncpy which is the culprit of the crash however in WinDBG I see: call ...