1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

... ntdll!* list all symbols of ntdll x /t /v MyDll!* list all symbol in MyDll with data type, symbol type and size x kernel32!*LoadLib* list all ...

2. !heap failed in windbg. Invalid type information f
(Forum/Crash Dump Analysis )

... Server 2003 SP2 x64 machine. From the following windbg log I see that loaded ntdll.dll image is incorrect and does not correspond to ntdll.pdb symbols. I have tried to specify the location to ntdll.dll ...

3. ASP hang
(Forum/Crash Dump Analysis )

... pool. The server is Windows 2003 and IIS6. Many thanks in advance. Here's the output: 0:000:x86> !analyze -v *** WARNING: symbols timestamp is wrong 0x499007dc 0x49900d5a for ntdll.dll ******************************************************************************* * ...

4. function plus offset question
(Forum/Crash Dump Analysis )

... and 0x60c? Thanks. 2 Id: 330.370 Suspend: 1 Teb: 7ffdc000 Unfrozen ChildEBP RetAddr 00deff14 7c90df5a ntdll!KiFastSystemCallRet 00deff18 7c8025db ntdll!ZwWaitForSingleObject+0xc 00deff7c ...

5. ntdll.dll symbols are missing?
(Forum/Symbol and Source Files )

Hi all. I have a problem with ntdll.dll symbols. Actually, I just have no .pdb files for it, however all of pdb's are downloaded from microsoft site (I use symbol server for windbg, actually). And when ...

6. Random Thread getting stuck
(Forum/User-Mode Debugging)

... so Audio Receiving threads) just stops. It doesn't exit but its not running either! Using WinDbg I can see the following call stack for the stuck thread: ntdll!NtWaitForMultipleObjects+0x15 (FPO: ...

7. Re: Determing cause of access denied - USN Journal
(Forum/Kernel-Mode Debugging)

... 7c90d3aa 7c80174d 00000788 00000000 ntdll!KiFastSystemCallRet 0007fbf8 7c9100b8 00090330 0007fcd0 7c910041 ntdll!ZwFsControlFile+0xc 1: kd> !irp 88666008 Irp is active with 10 stacks 10 is current ...

8. Re: function plus offset question
(Forum/Crash Dump Analysis )

The 0x* numbers are the offsets within a function code where a 'call' instruction is issued. ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject+0xc This means that ZwWaitForSingleObject calls ...

9. Re: Memory Access errors in the Kernel
(Forum/Kernel-Mode Debugging)

... RetAddr 0012f7a0 7c90d0ba ntdll!KiFastSystemCall+0x2 0012f7a4 7c8109b6 ntdll!NtCreateFile+0xc 0012f83c 0045c771 kernel32!CreateFileW+0x35f And the disassembly of ntdll!KiFastSystemCall: 0:000> ...

10. Re: ntdll.dll symbols are missing?
(Forum/Symbol and Source Files )

... that ntdll.pdb has been loaded. I debug XP SP3 so the symbols do fit the system. kd> !peb 7ffdb000 PEB at 7ffdb000 error 1 InitTypeRead( nt!_PEB at 7ffdb000)... However this value is the right ...

11. Re: sort lm n t by date/time
(Forum/Crash Dump Analysis )

... 13:08:51 2010 (4CE7BA53) 76ad0000 76b30000 IMM32 IMM32.DLL Sat Nov 20 13:08:51 2010 (4CE7BA53) 77570000 776f0000 ntdll ntdll.dll Sat Nov 20 13:08:56 2010 (4CE7BA58) 74c60000 74cc0000 ...

12. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

... again This time WinDbg is attached right after ntdll.dll has been loaded into our newly created address space. Now you can debug the windows loader which is actually implemented in large part in ntdll.dll. Note ...

13. Re:Question about COFF deprecation
(Forum/Symbol and Source Files )

... Windows operating systems." The PE headers and structures are read by the Windows loader (ntdll) - it contains all the information needed to spawn a new process. Note that the PE format hasn't changed ...

14. StackOverFlowException in .Net
(Forum/Crash Dump Analysis )

... 664d8cee 018f4dac 00000001 018ea380 0x12b110e [.....] 0019fe34 76f337c8 6fd54ddb 7ffd5000 00000000 ntdll!__RtlUserThreadStart+0x70 0019fe4c 00000000 6fd54ddb 7ffd5000 00000000 ntdll!_RtlUserThreadStart+0x1b *** ...