Where in the API is Andrew Richards?

Implementing ICorDebugManagedCallback2

AndrewRichards — Mon, 30 Jan 2012 20:42:57 GMT

Implementing ICorDebugManagedCallback2 isn't too hard, it just takes a lot of boiler-plate code to make ICorDebug happy. So as to make this easier for anyone who would like to implement ICorDebugManagedCallback2, attached is the template code to start from.

Enjoy!

Writing a Plug-in for Sysinternals ProcDump v4.0

AndrewRichards — Sat, 03 Dec 2011 00:49:21 GMT

My 4th MSDN Magazine article is now available online:

Writing a Plug-in for Sysinternals ProcDump v4.0

http://msdn.microsoft.com/en-us/magazine/hh580738.aspx

Fixing an ICorDebugUnmanagedCallback induced hang

AndrewRichards — Tue, 29 Nov 2011 18:32:13 GMT

Just posted an article on the NTDebugging blog about ICorDebugUnmanagedCallback::DebugEvent.

http://blogs.msdn.com/b/ntdebugging/archive/2011/11/29/fixing-an-icordebugunmanagedcallback-induced-hang.aspx

Debugger Engine (DbgEng) updates in the Windows 8 Developer Preview

AndrewRichards — Sat, 24 Sep 2011 20:20:00 GMT

Today I wanted to find out what the Debugger Engine (DbgEng) changes are between Windows 7 and the Windows 8 Developer Preview.

To get the differences, I did a WinDiff between the SDK 7.1 ‘DbgEng.h’ header file and the new version (C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\sdk\inc) shipped with the Windows 8 Developer Preview’s WDK (en_windows_developer_preview_wdk_x86_x64_741966.zip).

By just looking at the header file, you can easily see that there are lots of new goodies. Of major note is the support for inline debugging; this new feature has caused a few interface revisions and some additional constants.

So let’s dive in!

Global Functions

There is only one new global function. The DebugCreate function has been extended by adding Debugger Engine Options (DEBUG_ENGOPT_XXX) via the new DebugCreateEx function.

STDAPI
DebugCreateEx(
    _In_ REFIID InterfaceId,
    _In_ DWORD DbgEngOptions,
    _Out_ PVOID* Interface
    );

IDebugAdvanced2 Interface

The IDebugAdvanced2::Request function supports three new requests.

// InBuffer - ULONG64 for process server identification and ULONG as PID
// OutBuffer - Unused
#define DEBUG_REQUEST_WOW_PROCESS 31

// InBuffer - ULONG64 for process server identification and PWSTR as module path
// OutBuffer - Unused
#define DEBUG_REQUEST_WOW_MODULE 32

// InBuffer - Unused
// OutBuffer - Unused
// return - S_OK is non-invasive user-mode attach, S_FALSE if not (but still live user-mode), E_FAIL otherwise.
#define DEBUG_LIVE_USER_NON_INVASIVE 33

IDebugBreakpoint Interface

In alignment with the new inline debugging support, a new inline breakpoint has been added for use with IDebugBreakpoint::GetType.

#define DEBUG_BREAKPOINT_INLINE 3

IDebugBreakpoint3 Interface (new)

The new IDebugBreapkpoint3 interface has just a single function (GetGUID) that returns a GUID. This is the unique identifier of the breakpoint. The GUID can be passed to IDebugControl5::GetBreakpointByGuid to get the IDebugBreakpoint3 interface.

STDMETHOD(GetGuid)(
    THIS_
    _Out_ LPGUID Guid
    ) PURE;

IDebugClient2 Interface

There are two new DEBUG_FORMAT_XXX constants for use with IDebugClient2::WriteDumpFile2 and IDebugClient4::WriteDumpFileWide.

#define DEBUG_FORMAT_USER_SMALL_MODULE_HEADERS 0x00008000
#define DEBUG_FORMAT_USER_SMALL_FILTER_TRIAGE 0x00010000

IDebugClient6 Interface (new)

The new IDebugEventContextCallbacks interface can be set on the debugger client via IDebugClient6::SetEventContextCallbacks. This new event interface replaces the use of IDebugClient::SetEventCallbacks.

STDMETHOD(SetEventContextCallbacks)(
    THIS_
    _In_opt_ PDEBUG_EVENT_CONTEXT_CALLBACKS Callbacks
    ) PURE;

IDebugClient7 Interface (new)

The new SetClientContext function takes one of the new a DEBUG_CLIENT_XXX constants via the new DEBUG_CLIENT_CONTEXT structure. It is used to tailor the debugger client to the various (known) debugger applications. Integrated debugging in Visual Studio 2011 is DEBUG_CLIENT_VSINT.

// Client identification constants
#define DEBUG_CLIENT_UNKNOWN            0x0
#define DEBUG_CLIENT_VSINT              0x1
#define DEBUG_CLIENT_NTSD               0x2
#define DEBUG_CLIENT_NTKD               0x3
#define DEBUG_CLIENT_CDB                0x4
#define DEBUG_CLIENT_KD                 0x5
#define DEBUG_CLIENT_WINDBG             0x6
#define DEBUG_CLIENT_WINIDE             0x7

typedef struct _DEBUG_CLIENT_CONTEXT
{
UINT cbSize;
UINT eClient;
} DEBUG_CLIENT_CONTEXT, *PDEBUG_CLIENT_CONTEXT;

// IDebugClient7

STDMETHOD(SetClientContext)(
    THIS_
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

IDebugControl Interface

The Engine Options (DEBUG_ENGOPT_XXX) have been updated with a higher DEBUG_ENGOPT_ALL value and a new option to disable SQM (Software Quality Metrics – better known as Customer Experience Improvement Program). The options can be set via DebugCreateEx and IDebugControl::SetEngineOptions.

// Explicitly disable SQM upload.
#define DEBUG_ENGOPT_DISABLESQM 0x00080000
#define DEBUG_ENGOPT_ALL 0x000FFFFF

IDebugControl5 Interface (new)

The new inline frame support can be toggled off and on via .inline_query 0 and .inline_query 1 respectively (it is on by default).

#define DBG_FRAME_DEFAULT 0 // the same as INLINE_FRAME_CONTEXT_INIT in dbghelp.h
#define DBG_FRAME_IGNORE_INLINE 0xFFFFFFFF // the same as INLINE_FRAME_CONTEXT_IGNORE in dbghelp.h

The DEBUG_STACK_FRAME structure has been enhanced to support inline frames via the DEBUG_STACK_FRAME_EX structure.

typedef struct _DEBUG_STACK_FRAME_EX
{
    // First DEBUG_STACK_FRAME structure
    ULONG64 InstructionOffset;
    ULONG64 ReturnOffset;
    ULONG64 FrameOffset;
    ULONG64 StackOffset;
    ULONG64 FuncTableEntry;
    ULONG64 Params[4];
    ULONG64 Reserved[6];
    BOOL    Virtual;
    ULONG   FrameNumber;

    // Extended DEBUG_STACK_FRAME fields.
    ULONG InlineFrameContext;
    ULONG Reserved1; // For alignment purpose.
} DEBUG_STACK_FRAME_EX, *PDEBUG_STACK_FRAME_EX;

The IDebugControl5 interface has extended the stack functions to return the additional inline frames. Note, the older interfaces behave the same as before – they do not include inline frames.

// IDebugControl5
STDMETHOD(GetStackTraceEx)(
    THIS_
    _In_ ULONG64 FrameOffset,
    _In_ ULONG64 StackOffset,
    _In_ ULONG64 InstructionOffset,
    _Out_writes_to_(FramesSize,*FramesFilled) PDEBUG_STACK_FRAME_EX Frames,
    _In_ ULONG FramesSize,
    _Out_opt_ PULONG FramesFilled
    ) PURE;

STDMETHOD(OutputStackTraceEx)(
    THIS_
    _In_ ULONG OutputControl,
    _In_reads_opt_(FramesSize) PDEBUG_STACK_FRAME_EX Frames,
    _In_ ULONG FramesSize,
    _In_ ULONG Flags
    ) PURE;

STDMETHOD(GetContextStackTraceEx)(
    THIS_
    _In_reads_bytes_opt_(StartContextSize) PVOID StartContext,
    _In_ ULONG StartContextSize,
    _Out_writes_to_opt_(FramesSize,*FramesFilled) PDEBUG_STACK_FRAME_EX Frames,
    _In_ ULONG FramesSize,
    _Out_writes_bytes_opt_(FrameContextsSize) PVOID FrameContexts,
    _In_ ULONG FrameContextsSize,
    _In_ ULONG FrameContextsEntrySize,
    _Out_opt_ PULONG FramesFilled
    ) PURE;

STDMETHOD(OutputContextStackTraceEx)(
    THIS_
    _In_ ULONG OutputControl,
    _In_reads_(FramesSize) PDEBUG_STACK_FRAME_EX Frames,
    _In_ ULONG FramesSize,
    _In_reads_bytes_(FrameContextsSize) PVOID FrameContexts,
    _In_ ULONG FrameContextsSize,
    _In_ ULONG FrameContextsEntrySize,
    _In_ ULONG Flags
    ) PURE;

STDMETHOD(GetBreakpointByGuid)(
    THIS_
    _In_ LPGUID Guid,
    _Out_ PDEBUG_BREAKPOINT3* Bp
    ) PURE;

IDebugControl6 Interface (new)

The new IDebugControl6 interface contains functions to determine the state of debugging session’s connection.

// Returns additional info states for
STDMETHOD(GetExecutionStatusEx)(
    THIS_
    _Out_ PULONG Status
    ) PURE;

STDMETHOD(GetSynchronizationStatus)(
    THIS_
    _Out_ PULONG SendsAttempted,
    _Out_ PULONG SecondsSinceLastResponse
    ) PURE;

IDebugEventCallbacks Interface

The ‘Change Debuggee State’ flags (DEBUG_CDS_XXX) have a new value for refresh, and a new associated arguments (DEBUG_CDS_REFRESH_XXX). These are passed to IDebugEventCallbacks::ChangeDebuggeeState.

// Inform the GUI clients to refresh debugger windows.
#define DEBUG_CDS_REFRESH 0x00000004

// DEBUG_CDS_REFRESH IDs
#define DEBUG_CDS_REFRESH_EVALUATE                  1
#define DEBUG_CDS_REFRESH_EXECUTE                   2
#define DEBUG_CDS_REFRESH_EXECUTECOMMANDFILE        3
#define DEBUG_CDS_REFRESH_ADDBREAKPOINT             4
#define DEBUG_CDS_REFRESH_REMOVEBREAKPOINT          5
#define DEBUG_CDS_REFRESH_WRITEVIRTUAL              6
#define DEBUG_CDS_REFRESH_WRITEVIRTUALUNCACHED      7
#define DEBUG_CDS_REFRESH_WRITEPHYSICAL             8
#define DEBUG_CDS_REFRESH_WRITEPHYSICAL2            9
#define DEBUG_CDS_REFRESH_SETVALUE                 10
#define DEBUG_CDS_REFRESH_SETVALUE2                11
#define DEBUG_CDS_REFRESH_SETSCOPE                 12
#define DEBUG_CDS_REFRESH_SETSCOPEFRAMEBYINDEX     13
#define DEBUG_CDS_REFRESH_SETSCOPEFROMJITDEBUGINFO 14
#define DEBUG_CDS_REFRESH_SETSCOPEFROMSTOREDEVENT 15

IDebugEventContextCallbacks Interface (new)

The new IDebugEventContextCallbacks interface is the same as the IDebugEventCallbacks interface but adds the new DEBUG_EVENT_CONTEXT structure to each function.

typedef struct _DEBUG_EVENT_CONTEXT
{
    ULONG Size;
    ULONG ProcessEngineId;
    ULONG ThreadEngineId;
    ULONG FrameEngineId;
} DEBUG_EVENT_CONTEXT, *PDEBUG_EVENT_CONTEXT;

// IDebugEventContextCallbacks.

// The engine calls GetInterestMask once when
// the event callbacks are set for a client.
STDMETHOD(GetInterestMask)(
    THIS_
    _Out_ PULONG Mask
    ) PURE;

// A breakpoint event is generated when
// a breakpoint exception is received and
// it can be mapped to an existing breakpoint.
// The callback method is given a reference
// to the breakpoint and should release it when
// it is done with it.
STDMETHOD(Breakpoint)(
    THIS_
    _In_ PDEBUG_BREAKPOINT2 Bp,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

// Exceptions include breaks which cannot
// be mapped to an existing breakpoint
// instance.
STDMETHOD(Exception)(
    THIS_
    _In_ PEXCEPTION_RECORD64 Exception,
    _In_ ULONG FirstChance,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

// Any of these values can be zero if they
// cannot be provided by the engine.
// Currently the kernel does not return thread
// or process change events.
STDMETHOD(CreateThread)(
    THIS_
    _In_ ULONG64 Handle,
    _In_ ULONG64 DataOffset,
    _In_ ULONG64 StartOffset,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

STDMETHOD(ExitThread)(
    THIS_
    _In_ ULONG ExitCode,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

// Any of these values can be zero if they
// cannot be provided by the engine.
STDMETHOD(CreateProcess)(
    THIS_
    _In_ ULONG64 ImageFileHandle,
    _In_ ULONG64 Handle,
    _In_ ULONG64 BaseOffset,
    _In_ ULONG ModuleSize,
    _In_opt_ PCWSTR ModuleName,
    _In_opt_ PCWSTR ImageName,
    _In_ ULONG CheckSum,
    _In_ ULONG TimeDateStamp,
    _In_ ULONG64 InitialThreadHandle,
    _In_ ULONG64 ThreadDataOffset,
    _In_ ULONG64 StartOffset,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

STDMETHOD(ExitProcess)(
    THIS_
    _In_ ULONG ExitCode,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

// Any of these values may be zero.
STDMETHOD(LoadModule)(
    THIS_
    _In_ ULONG64 ImageFileHandle,
    _In_ ULONG64 BaseOffset,
    _In_ ULONG ModuleSize,
    _In_opt_ PCWSTR ModuleName,
    _In_opt_ PCWSTR ImageName,
    _In_ ULONG CheckSum,
    _In_ ULONG TimeDateStamp,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

STDMETHOD(UnloadModule)(
    THIS_
    _In_opt_ PCWSTR ImageBaseName,
    _In_ ULONG64 BaseOffset,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

STDMETHOD(SystemError)(
    THIS_
    _In_ ULONG Error,
    _In_ ULONG Level,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

// Session status is synchronous like the other
// wait callbacks but it is called as the state
// of the session is changing rather than at
// specific events so its return value does not
// influence waiting. Implementations should just
// return DEBUG_STATUS_NO_CHANGE.
// Also, because some of the status
// notifications are very early or very
// late in the session lifetime there may not be
// current processes or threads when the notification
// is generated.
STDMETHOD(SessionStatus)(
    THIS_
    _In_ ULONG Status
    ) PURE;

// The following callbacks are informational
// callbacks notifying the provider about
// changes in debug state. The return value
// of these callbacks is ignored. Implementations
// can not call back into the engine.

// Debuggee state, such as registers or data spaces,
// has changed.
STDMETHOD(ChangeDebuggeeState)(
    THIS_
    _In_ ULONG Flags,
    _In_ ULONG64 Argument,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

// Engine state has changed.
STDMETHOD(ChangeEngineState)(
    THIS_
    _In_ ULONG Flags,
    _In_ ULONG64 Argument,
    _In_reads_bytes_(ContextSize) PVOID Context,
    _In_ ULONG ContextSize
    ) PURE;

// Symbol state has changed.
STDMETHOD(ChangeSymbolState)(
    THIS_
    _In_ ULONG Flags,
    _In_ ULONG64 Argument
    ) PURE;

IDebugSymbols3 Interface

The ‘Get Source Entries by Line’ flags (DEBUG_GSEL_XXX) has an addition entry for inline functions. The constant is passed to IDebugSymbols3::GetSourceEntriesByLine.

// Only return caller sites of the inline function
#define DEBUG_GSEL_INLINE_CALLSITE 0x00000010

IDebugSymbols4 Interface (new)

The IDebugSymbols4 interface allows you to determine the symbol of an inline frame.

STDMETHOD(GetScopeEx)(
    THIS_
    _Out_opt_ PULONG64 InstructionOffset,
    _Out_opt_ PDEBUG_STACK_FRAME_EX ScopeFrame,
    _Out_writes_bytes_opt_(ScopeContextSize) PVOID ScopeContext,
    _In_ ULONG ScopeContextSize
    ) PURE;

STDMETHOD(SetScopeEx)(
    THIS_
    _In_ ULONG64 InstructionOffset,
    _In_opt_ PDEBUG_STACK_FRAME_EX ScopeFrame,
    _In_reads_bytes_opt_(ScopeContextSize) PVOID ScopeContext,
    _In_ ULONG ScopeContextSize
    ) PURE;

STDMETHOD(GetNameByInlineContext)(
    THIS_
    _In_ ULONG64 Offset,
    _In_ ULONG InlineContext,
    _Out_writes_opt_(NameBufferSize) PSTR NameBuffer,
    _In_ ULONG NameBufferSize,
    _Out_opt_ PULONG NameSize,
    _Out_opt_ PULONG64 Displacement
    ) PURE;

STDMETHOD(GetNameByInlineContextWide)(
    THIS_
    _In_ ULONG64 Offset,
    _In_ ULONG InlineContext,
    _Out_writes_opt_(NameBufferSize) PWSTR NameBuffer,
    _In_ ULONG NameBufferSize,
    _Out_opt_ PULONG NameSize,
    _Out_opt_ PULONG64 Displacement
    ) PURE;

STDMETHOD(GetLineByInlineContext)(
    THIS_
    _In_ ULONG64 Offset,
    _In_ ULONG InlineContext,
    _Out_opt_ PULONG Line,
    _Out_writes_opt_(FileBufferSize) PSTR FileBuffer,
    _In_ ULONG FileBufferSize,
    _Out_opt_ PULONG FileSize,
    _Out_opt_ PULONG64 Displacement
    ) PURE;

STDMETHOD(GetLineByInlineContextWide)(
    THIS_
    _In_ ULONG64 Offset,
    _In_ ULONG InlineContext,
    _Out_opt_ PULONG Line,
    _Out_writes_opt_(FileBufferSize) PWSTR FileBuffer,
    _In_ ULONG FileBufferSize,
    _Out_opt_ PULONG FileSize,
    _Out_opt_ PULONG64 Displacement
    ) PURE;

STDMETHOD(OutputSymbolByInlineContext)(
    THIS_
    _In_ ULONG OutputControl,
    _In_ ULONG Flags,
    _In_ ULONG64 Offset,
    _In_ ULONG InlineContext
    ) PURE;

IDebugSymbols5 Interface (new)

And last, but definitely not least, is the new IDebugSymbols5 interface allows you to set and get the current frame by index (i.e. the same operation as .frame NN).

// IDebugSymbols5
STDMETHOD(GetCurrentScopeFrameIndexEx)(
    THIS_
    _In_ ULONG Flags,
    _Out_ PULONG Index
    ) PURE;

STDMETHOD(SetScopeFrameByIndexEx)(
    THIS_
    _In_ ULONG Flags,
    _In_ ULONG Index
    ) PURE;

Conclusion

As you can see, this release of the debugger is quite significant. The integration in to Visual Studio, the support for inline function debugging, and the greatly improved local variable support are all great features that we’ll all get immediate productivity improvement from.

SQL Server 2008 R2 Setup fails with Database Engine Handle error

AndrewRichards — Sun, 28 Aug 2011 22:53:15 GMT

To cut a long story short, if you install SQL Server 2008 R2 via ISO mount in Virtual PC, the install will fail with a Database Engine Handle error.

To get out of this issue:

Uninstall everything to do with SQL Server (from Programs and Features)
Extract the ISO to a folder using WinRAR (do not use WinZIP, I've found articles suggesting that WinZIP doesn't extract the files correctly - no doubt the same issue that Virtual PC has)
Install from the extracted folder instead

BugCheck 0x101 - CLOCK_WATCHDOG_TIMEOUT

AndrewRichards — Tue, 31 May 2011 04:23:00 GMT

My blog post on a BugCheck 0x101 - CLOCK_WATCHDOG_TIMEOUT is now live on the NTDebugging blog...

http://blogs.msdn.com/b/ntdebugging/archive/2011/10/26/debugging-a-clock-watchdog-timeout-bugcheck.aspx

Intel “Family Model Stepping” and Intel “Erratum” Reference

AndrewRichards — Sat, 21 May 2011 04:56:00 GMT

For some unfathomable reason, there seems to be no simple chart cross referencing the common CPU names, their basic features, and the internal CPU information identification (provided by !cpuid and !sysinfo cpuinfo). (There is also no clear description as to why !sysinfo cpuinfo doesn’t match !sysinfo cpumicrocode, but that’s a chart that’ll have to wait.)

Going forward, I’m going to record the Family/Model/Stepping information in this blog entry for each kernel dump I see at work each day. Since I see quite a varied array of old and new hardware, the list should flesh out nicely over time…

The entries that I’ve verified will have a [!cpuid: F/M/S Manufacturer Mhz] entry on the end of the line.

lkd> !cpuid
CP F/M/S Manufacturer     MHz
0 6,30,5 GenuineIntel    2799
1 6,30,5 GenuineIntel    2800
2 6,30,5 GenuineIntel    2800
3 6,30,5 GenuineIntel    2800

The entries that I’ve verified might also have a [!sysinfo cpuinfo: Process Name] entry on the end of the line (!sysinfo cpuinfo sometimes doesn’t work).

lkd> !sysinfo cpuinfo
[CPU Information]
~MHz = REG_DWORD 3192
Component Information = REG_BINARY 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
Configuration Data = REG_FULL_RESOURCE_DESCRIPTOR ff,ff,ff,ff,ff,ff,ff,ff,0,0,0,0,0,0,0,0
Identifier = REG_SZ Intel64 Family 15 Model 6 Stepping 4
ProcessorNameString = REG_SZ Intel(R) Pentium(R) D CPU 3.20GHz
Update Signature = REG_BINARY 0,0,0,0,4,0,0,0
Update Status = REG_DWORD 6
VendorIdentifier = REG_SZ GenuineIntel
MSR8B = REG_QWORD 400000000

The Family/Model/Stepping title above each processor group is information I have gathered from somewhere on the Internet but haven’t verified with a debugger.

Also when appropriate, I’ll link to the Intel (Processor) Erratum document for the family (this is the document that describes the bugs in the processor) and the Microsoft Hotfix that implements a workaround.

Legacy Processors

Family Code
    Model Number
           Description
04 00 Intel486? DX processors
04 02 Intel486 SX processors
04 03 Intel487? processors
04 03 IntelDX2? processors
04 03 IntelDX2 OverDrive® processors
04 04 Intel486 SL processor
04 05 IntelSX2? processors
04 07 Write-Back Enhanced IntelDX2 processors
04 08 IntelDX4? processors
04 08 IntelDX4 OverDrive processors
05 01 Pentium® processors (60, 66)
05 02 Pentium processors (75, 90, 100, 120, 133, 150, 166, 200)
05 01 Pentium OverDrive processor for Pentium processor (60, 66)
05 02 Pentium OverDrive processor for Pentium processor
                  (75, 90, 100, 120, 133)
05 03 Pentium OverDrive processors for Intel486 processors
05 04 Pentium processor with MMX? technology (166, 200)
05 04 Pentium OverDrive processor with MMX? technology for
             Pentium processor (75, 90, 100, 120, 133)
06 01 Pentium Pro processor
06 03 Pentium II processor, model 3
06 05 Pentium II processor, model 5, Pentium II Xeon processor,
                  model 5, and Intel Celeron processor, model 5. Note(5)
06 06 Intel Celeron processor, model 6
06 07 Pentium III processor, model 7, and Pentium III Xeon processor,
                  model 7. Note(6)
06 08 Pentium III processor, model 8, Pentium III Xeon processor,
                  model 8, and Intel Celeron processor, model 8. Note(7)
06 09 Intel Pentium M processor model 9.
06 10 Pentium III Xeon processor, model A
06 11 Pentium III processor, model B
06 13 Intel Pentium M processor model D.
06 03 Intel Pentium II OverDrive processor
15 00 Intel Pentium 4 processor or Intel Xeon processor
15 01 Pentium 4 processor, Intel Xeon processor, Intel Xeon processor MP,
                  and Intel Celeron processor.
15 02 Pentium 4 processor, Mobile Intel Pentium 4 processor – M, Intel
                  Xeon processor, Intel Xeon processor MP, Intel Celeron
                  processor, and Mobile Intel Celeron processor.
15 03 Pentium 4 processor, Mobile Intel Pentium 4 processor – M, Intel
                  Xeon processor, Intel Celeron processor.

64-bit Processors: Intel 64 – ‘NetBurst’ microarchitecture

Family 15, Model 6, Stepping 4
Pentium D – 3.20 GHz (2×1 MB L2) [!cpuid: 15,6,4 GenuineIntel 3192][!sysinfo cpuinfo: Intel(R) Pentium(R) D CPU 3.20GHz]

64-bit Processors: Intel 64 – ‘Core’ microarchitecture

Xeon 5160 – 3.00 GHz (4 MB L2, 1333 MHz FSB)(80 W)
Xeon 5150 – 2.66 GHz (4 MB L2, 1333 MHz FSB)(65 W)
Xeon 5140 – 2.33 GHz (4 MB L2, 1333 MHz FSB)(65 W)
Xeon 5130 – 2.00 GHz (4 MB L2, 1333 MHz FSB)(65 W)
Xeon 5120 – 1.86 GHz (4 MB L2, 1066 MHz FSB)(65 W)
Xeon 5110 – 1.60 GHz (4 MB L2, 1066 MHz FSB)(65 W)
Xeon 5148LV – 2.33 GHz (4 MB L2, 1333 MHz FSB, 40 W)(Low Voltage)

Family 6, Model 15, Stepping 7
Xeon X5355 – 2.66 GHz (2×4 MB L2, 1333 MHz FSB)(105 W)
Xeon E5345 – 2.33 GHz (2×4 MB L2, 1333 MHz FSB)(80 W)
Xeon E5335 – 2.00 GHz (2×4 MB L2, 1333 MHz FSB)(80 W)
Xeon E5320 – 1.86 GHz (2×4 MB L2, 1066 MHz FSB)(65 W) [!cpuid: 6,15,7 GenuineIntel 1861][!sysinfo cpuinfo: Intel(R) Xeon(R) CPU E5320 @ 1.86GHz]
Xeon E5310 – 1.60 GHz (2×4 MB L2, 1066 MHz FSB)(65 W)
Xeon L5320 – 1.86 GHz (2×4 MB L2, 1066 MHz FSB)(50 W)(Low Voltage)

Family 6, Model 23, Stepping 6
Xeon E5405 – 2.00 GHz (4 cores, 4 MB L3) [!cpuid: 6,23,6 GenuineIntel 2000][!sysinfo cpuinfo: Intel(R) Xeon(R) CPU E5405 @ 2.00GHz]

Family 6, Model 15, Stepping 6
Core 2 Duo E6850 – 3.00 GHz (4 MB L2, 1333 MHz FSB)
Core 2 Duo X6800 – 2.93 GHz (4 MB L2, 1066 MHz FSB)
Core 2 Duo E6750 – 2.67 GHz (4 MB L2, 1333 MHz FSB)
Core 2 Duo E6700 – 2.67 GHz (4 MB L2, 1066 MHz FSB)
Core 2 Duo E6600 – 2.40 GHz (4 MB L2, 1066 MHz FSB)
Core 2 Duo E6550 – 2.33 GHz (4 MB L2, 1333 MHz FSB)
Core 2 Duo E6420 – 2.13 GHz (4 MB L2, 1066 MHz FSB)
Core 2 Duo E6400 – 2.13 GHz (2 MB L2, 1066 MHz FSB)
Core 2 Duo E6320 – 1.86 GHz (4 MB L2, 1066 MHz FSB)
Core 2 Duo E6300 – 1.86 GHz (2 MB L2, 1066 MHz FSB)

Core 2 Duo E4700 – 2.60 GHz (2 MB L2, 800 MHz FSB)
Core 2 Duo E4600 – 2.40 GHz (2 MB L2, 800 MHz FSB)
Core 2 Duo E4500 – 2.20 GHz (2 MB L2, 800 MHz FSB)
Core 2 Duo E4400 – 2.00 GHz (2 MB L2, 800 MHz FSB)
Core 2 Duo E4300 – 1.80 GHz (2 MB L2, 800 MHz FSB)

Family 6, Model 15, Stepping 6
Core 2 Duo T7800 – 2.60 GHz (4 MB L2, 800 MHz FSB)
Core 2 Duo T7700 – 2.40 GHz (4 MB L2, 800 MHz FSB)
Core 2 Duo T7600 – 2.33 GHz (4 MB L2, 667 MHz FSB)
Core 2 Duo T7500 – 2.20 GHz (4 MB L2, 800 MHz FSB)
Core 2 Duo T7400 – 2.16 GHz (4 MB L2, 667 MHz FSB)
Core 2 Duo T7300 – 2.00 GHz (4 MB L2, 800 MHz FSB)
Core 2 Duo T7250 – 2.00 GHz (2 MB L2, 800 MHz FSB)
Core 2 Duo T7200 – 2.00 GHz (4 MB L2, 667 MHz FSB)
Core 2 Duo T7100 – 1.80 GHz (2 MB L2, 800 MHz FSB)
Core 2 Duo T5600 – 1.83 GHz (2 MB L2, 667 MHz FSB)
Core 2 Duo T5550 – 1.83 GHz (2 MB L2, 667 MHz FSB)(no VT)
Core 2 Duo T5500 – 1.66 GHz (2 MB L2, 667 MHz FSB)(no VT)
Core 2 Duo T5470 – 1.60 GHz (2 MB L2, 800 MHz FSB)(no VT)
Core 2 Duo T5450 – 1.66 GHz (2 MB L2, 667 MHz FSB)(no VT)
Core 2 Duo T5300 – 1.73 GHz (2 MB L2, 533 MHz FSB)(no VT)
Core 2 Duo T5270 – 1.40 GHz (2 MB L2, 800 MHz FSB)(no VT)
Core 2 Duo T5250 – 1.50 GHz (2 MB L2, 667 MHz FSB)(no VT)
Core 2 Duo T5200 – 1.60 GHz (2 MB L2, 533 MHz FSB)(no VT)
Core 2 Duo L7500 – 1.60 GHz (4 MB L2, 800 MHz FSB)(Low Voltage)
Core 2 Duo L7400 – 1.50 GHz (4 MB L2, 667 MHz FSB)(Low Voltage)
Core 2 Duo L7300 – 1.40 GHz (4 MB L2, 800 MHz FSB)(Low Voltage)
Core 2 Duo L7200 – 1.33 GHz (4 MB L2, 667 MHz FSB)(Low Voltage)
Core 2 Duo U7700 – 1.33 GHz (2 MB L2, 533 MHz FSB)(Ultra Low Voltage)
Core 2 Duo U7600 – 1.20 GHz (2 MB L2, 533 MHz FSB)(Ultra Low Voltage)
Core 2 Duo U7500 – 1.06 GHz (2 MB L2, 533 MHz FSB)(Ultra Low Voltage)

Family 6, Model 15, Stepping 11
Core 2 Extreme QX6850 – 3 GHz (2×4 MB L2 Cache, 1333 MHz FSB)
Core 2 Extreme QX6800 – 2.93 GHz (2×4 MB L2 Cache, 1066 MHz FSB)
Core 2 Extreme QX6700 – 2.66 GHz (2×4 MB L2 Cache, 1066 MHz FSB)
Core 2 Quad Q6700 – 2.66 GHz (2×4 MB L2 Cache, 1066 MHz FSB)
Core 2 Quad Q6600 – 2.40 GHz (2×4 MB L2 Cache, 1066 MHz FSB)

Core 2 Duo E8600 – 3.33 GHz (6 MB L2, 1333 MHz FSB)
Core 2 Duo E8500 – 3.16 GHz (6 MB L2, 1333 MHz FSB)
Core 2 Duo E8400 – 3.00 GHz (6 MB L2, 1333 MHz FSB)
Core 2 Duo E8300 – 2.83 GHz (6 MB L2, 1333 MHz FSB)
Core 2 Duo E8200 – 2.66 GHz (6 MB L2, 1333 MHz FSB)
Core 2 Duo E8190 – 2.66 GHz (6 MB L2, 1333 MHz FSB)(no TXT, no VT)

Core 2 Duo E7600 – 3.06 GHz (3 MB L2, 1066 MHz FSB)
Core 2 Duo E7500 – 2.93 GHz (3 MB L2, 1066 MHz FSB)
Core 2 Duo E7400 – 2.80 GHz (3 MB L2, 1066 MHz FSB)
Core 2 Duo E7300 – 2.66 GHz (3 MB L2, 1066 MHz FSB)
Core 2 Duo E7200 – 2.53 GHz (3 MB L2, 1066 MHz FSB)

Core 2 Extreme QX9770 – 3.20 GHz (2×6 MB L2, 1600 MHz FSB)
Core 2 Extreme QX9650 – 3.00 GHz (2×6 MB L2, 1333 MHz FSB)
Core 2 Quad Q9650 – 3 GHz (2×6 MB L2, 1333 MHz FSB)
Core 2 Quad Q9550 – 2.83 GHz (2×6 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q9550s – 2.83 GHz (2×6 MB L2, 1333 MHz FSB)(65W TDP)
Core 2 Quad Q9450 – 2.66 GHz (2×6 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q9505 – 2.83 GHz (2×3 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q9505s – 2.83 GHz (2×3 MB L2, 1333 MHz FSB)(65W TDP)
Core 2 Quad Q9500 – 2.83 GHz (2×3 MB L2, 1333 MHz FSB)(95W TDP)(no TXT)
Core 2 Quad Q9400 – 2.66 GHz (2×3 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q9400s – 2.66 GHz (2×3 MB L2, 1333 MHz FSB)(65W TDP)
Core 2 Quad Q9300 – 2.50 GHz (2×3 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q8400 – 2.66 GHz (2×2 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q8400s – 2.66 GHz (2×2 MB L2, 1333 MHz FSB)(65W TDP)
Core 2 Quad Q8300 – 2.50 GHz (2×2 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q8300s – 2.50 GHz (2×2 MB L2, 1333 MHz FSB)(65W TDP)
Core 2 Quad Q8200 – 2.33 GHz (2×2 MB L2, 1333 MHz FSB)(95W TDP)
Core 2 Quad Q8200s – 2.33 GHz (2×2 MB L2, 1333 MHz FSB)(65W TDP)
Core 2 Quad Q7600 – 2.70 GHz (2×1 MB L2, 800 MHz FSB)(no SSE4)

Core 2 Quad Q9100 – 2.26 GHz (2×6 MB L2, 1066 MHz FSB)(45W TDP)
Core 2 Quad Q9000 – 2.00 GHz (2×3 MB L2, 1066 MHz FSB)(45W TDP)

Intel Pentium E2220 – 2.40 GHz (1 MB L2, 800 MHz FSB)
Intel Pentium E2200 – 2.20 GHz (1 MB L2, 800 MHz FSB)
Intel Pentium E2180 – 2.00 GHz (1 MB L2, 800 MHz FSB)
Intel Pentium E2160 – 1.80 GHz (1 MB L2, 800 MHz FSB)
Intel Pentium E2140 – 1.60 GHz (1 MB L2, 800 MHz FSB)

Intel Pentium E6800 – 3.33 GHz (2 MB L2,1066 MHz FSB)
Intel Pentium E6700 – 3.20 GHz (2 MB L2,1066 MHz FSB)
Intel Pentium E6600 – 3.06 GHz (2 MB L2,1066 MHz FSB)
Intel Pentium E6500 – 2.93 GHz (2 MB L2,1066 MHz FSB)
Intel Pentium E6300 – 2.80 GHz (2 MB L2,1066 MHz FSB)
Intel Pentium E5700 – 3.00 GHz (2 MB L2, 800 MHz FSB)
Intel Pentium E5500 – 2.80 GHz (2 MB L2, 800 MHz FSB)
Intel Pentium E5400 – 2.70 GHz (2 MB L2, 800 MHz FSB)
Intel Pentium E5300 – 2.60 GHz (2 MB L2, 800 MHz FSB)
Intel Pentium E5200 – 2.50 GHz (2 MB L2, 800 MHz FSB)
Intel Pentium E2210 – 2.20 GHz (1 MB L2, 800 MHz FSB)

Intel Celeron E1600 – 2.40 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron E1500 – 2.20 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron E1400 – 2.00 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron E1300 – 1.80 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron E1200 – 1.60 GHz (512 KB L2, 800 MHz FSB)

Intel Celeron E3500 – 2.70 GHz (1 MB L2, 800 MHz FSB)
Intel Celeron E3400 – 2.60 GHz (1 MB L2, 800 MHz FSB)
Intel Celeron E3300 – 2.50 GHz (1 MB L2, 800 MHz FSB)
Intel Celeron E3200 – 2.40 GHz (1 MB L2, 800 MHz FSB)

Intel Celeron 450 – 2.20 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron 440 – 2.00 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron 430 – 1.80 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron 420 – 1.60 GHz (512 KB L2, 800 MHz FSB)
Intel Celeron 220 – 1.20 GHz (512 KB L2, 533 MHz FSB)

Intel Celeron 445 – 1.87 GHz (512 KB L2, 1066 MHz FSB)

Intel Celeron M 560 – 2.13 GHz (1 MB L2, 533 MHz FSB)
Intel Celeron M 550 – 2.00 GHz (1 MB L2, 533 MHz FSB)
Intel Celeron M 540 – 1.86 GHz (1 MB L2, 533 MHz FSB)
Intel Celeron M 530 – 1.73 GHz (1 MB L2, 533 MHz FSB)
Intel Celeron M 520 – 1.60 GHz (1 MB L2, 533 MHz FSB)

64-bit Processors: Intel 64 – ‘Nehalem’ microarchitecture

Pentium G6950 - 2.8 GHz (No HyperThreading)

Core i3 560 – 3.33 GHz Hyper-Threading (4 MB L3)
Core i3 550 – 3.2 GHz Hyper-Threading (4 MB L3)
Core i3 540 – 3.06 GHz Hyper-Threading (4 MB L3)
Core i3 530 – 2.93 GHz Hyper-Threading (4 MB L3)

Family 6, Model 30, Stepping 5 (a.k.a. Family 6, Model 1E, Stepping 5)
Core i5 760 – 2.80 GHz/3.33 GHz Turbo Boost (8 MB L3) [!cpuid: 6,30,5 GenuineIntel 2800]
Core i5 750 – 2.66 GHz/3.20 GHz Turbo Boost (8 MB L3)
Core i5 750S – 2.40 GHz/3.20 GHz Turbo Boost (8 MB L3)

Core i5 680 – 3.60 GHz Hyper-Threading Turbo Boost (4 MB L3)
Core i5 670 – 3.46 GHz Hyper-Threading Turbo Boost (4 MB L3)
Core i5 661 – 3.33 GHz Hyper-Threading Turbo Boost (4 MB L3)
Core i5 660 – 3.33 GHz Hyper-Threading Turbo Boost (4 MB L3)
Core i5 655K – 3.2 GHz Hyper-Threading Turbo Boost (4 MB L3)
Core i5 650 – 3.2 GHz Hyper-Threading Turbo Boost (4 MB L3)

Intel Erratum AAJ121 / Microsoft Hotfix KB975530 (BugCheck 0x101 with Hyper-V)
Core i7 975 Extreme – 3.33 GHz/3.60 GHz Turbo Boost (8 MB L3)
Core i7 965 Extreme – 3.20 GHz/3.46 GHz Turbo Boost (8 MB L3)
Core i7 960 - 3.20 GHz/3.46 GHz Turbo Boost (8 MB L3)
Core i7 950 – 3.06 GHz/3.33 GHz Turbo Boost (8 MB L3)
Core i7 940 – 2.93 GHz/3.20 GHz Turbo Boost (8 MB L3)
Core i7 930 – 2.80 GHz/3.06 GHz Turbo Boost (8 MB L3)
Core i7 920 – 2.66 GHz/2.93 GHz Turbo Boost (8 MB L3)

Core i7 880 – 3.06 GHz/3.73 GHz Turbo Boost (8 MB L3)(95W TDP)
Core i7 875K – 2.93 GHz/3.60 GHz Turbo Boost (8 MB L3)(95W TDP)
Core i7 870 – 2.93 GHz/3.60 GHz Turbo Boost (8 MB L3)(95W TDP)
Core i7 870S – 2.67 GHz/3.60 GHz Turbo Boost (8 MB L3)(82W TDP)
Core i7 860 – 2.80 GHz/3.46 GHz Turbo Boost (8 MB L3)(95W TDP)
Core i7 860S – 2.53 GHz/3.46 GHz Turbo Boost (8 MB L3)(82W TDP)

Core i7 990X Extreme - 3.46 GHz/3.73 GHz Turbo Boost (12 MB L3)
Core i7 980X Extreme - 3.33 GHz/3.60 GHz Turbo Boost (12 MB L3)
Core i7 970 - 3.20 GHz/3.46 GHz Turbo Boost (12 MB L3)

Core i7 940XM Extreme - 2.13 GHz/3.33 GHz Turbo Boost (8 MB L3)(55W TDP)
Core i7 920XM Extreme - 2.00 GHz/3.20 GHz Turbo Boost (8 MB L3)(55W TDP)
Core i7 840QM - 1.86 GHz/3.20 GHz Turbo Boost (8 MB L3)(45W TDP)
Core i7 820QM - 1.73 GHz/3.06 GHz Turbo Boost (8 MB L3)(45W TDP)
Core i7 740QM - 1.73 GHz/2.93 GHz Turbo Boost (6 MB L3)(45W TDP)
Core i7 720QM - 1.60 GHz/2.80 GHz Turbo Boost (6 MB L3)(45W TDP)

Xeon W5590 – 3.33 GHz (4 Cores, 8 MB L3)(HT)(130W)
Xeon W5580 – 3.20 GHz (4 Cores, 8 MB L3)(HT)(130W)
Xeon X5570 – 2.93 GHz (4 Cores, 8 MB L3)(HT)(95W)
Xeon X5560 – 2.80 GHz (4 Cores, 8 MB L3)(HT)(95W)
Xeon X5550 – 2.66 GHz (4 Cores, 8 MB L3)(HT)(95W)
Xeon L5530 – 2.40 GHz (4 Cores, 8 MB L3)(HT)(60W)
Xeon L5520 – 2.26 GHz (4 Cores, 8 MB L3)(HT)(60W)
Xeon L5518 – 2.13 GHz (4 Cores, 8 MB L3)(HT)(60W)
Xeon L5508 – 2.00 GHz (2 Cores, 8 MB L3)(HT)(38W)
Xeon L5506 – 2.13 GHz (4 Cores, 8 MB L3)(60W)

Xeon E5540 – 2.53 GHz (4 Cores, 8 MB L3)(HT)
Xeon E5530 – 2.40 GHz (4 Cores, 8 MB L3)(HT)
Xeon E5520 – 2.26 GHz (4 Cores, 8 MB L3)(HT)

Xeon E5507 – 2.26 GHz (4 cores, 4 MB L3)
Xeon E5506 – 2.13 GHz (4 cores, 4 MB L3)
Xeon E5505 – 2.00 GHz (4 cores, 4 MB L3)
Xeon E5504 – 2.00 GHz (4 cores, 4 MB L3)
Xeon E5503 – 2.00 GHz (2 cores, 4 MB L3)

References:-

Specification Updates/Erratum
Intel® Core™ i7-900 Desktop Processor Series - http://download.intel.com/design/processor/specupdt/320836.pdf
Intel® Core™ i7-800 Desktop Processor Series - http://download.intel.com/design/processor/specupdt/322166.pdf
Intel® Core™ i5-700 Desktop Processor Series - http://download.intel.com/design/processor/specupdt/322166.pdf
Intel® Xeon® Processor 5500 Series - http://www.intel.com/assets/pdf/specupdate/321324.pdf

Processor Lists
Intel® Microprocessors - http://en.wikipedia.org/wiki/List_of_Intel_microprocessors
Intel® Processor Identification Utility - http://www.intel.com/p/en_US/support/highlights/processors/toolspiu
Intel® Xeon® Processor 5300 Series - http://ark.intel.com/ProductCollection.aspx?series=30807
Intel® Xeon® Processor 5400 Series - http://ark.intel.com/ProductCollection.aspx?series=33905
Intel® Xeon® Processor 5500 Series - http://ark.intel.com/ProductCollection.aspx?series=39565
Intel® Xeon® Processor 5600 Series - http://ark.intel.com/ProductCollection.aspx?series=47915

WinDbg File Association and Explorer Context Menu

AndrewRichards — Thu, 05 May 2011 08:00:00 GMT

For a long time now I've had a registry file to make context menu entries for WinDbg. The entries allow you to select the x86 or x64 debugger. Internally at Microsoft, I have another version of the registry file that contains two more context menu entries for the private symbol server. You can see all 4 options I add internally in this screenshot.

Note, the registry file assumes WinDBG is installed in c:\debuggers_x86 and c:\debuggers (for the x86 and AMD64 debuggers respectively). FYI: The reason you need to install the debugger twice is the lack of architecture agnostic support in some extensions - yes, SOS.DLL I'm looking at you. The multiple entries give you a quick way of jumping between the two architectures.

The registry entries pass in the symbol path for the Microsoft Public Symbol Server (http://msdl.microsoft.com/download/symbols) and for me, the Microsoft Private Symbol Server. In both cases, the symbols are cached locally (e.g. c:\symbols) through SRV* chaining. Much like the architecture entries, this technique gives you a quick way to toggle between (in my case) the public and private symbols. The passing of the symbol path, as opposed to using the _NT_SYMBOL_PATH environment variable is the only way to get around the concatination that WinDBG does. If you have the environment variable set, it will be prepended to the symbol path passed. This means that a environment variable path could still be used instead of a passed path. I'll admit that this is only an issue for people needing support of both symbols stores and that for the vast majority of people, the environment variable is a better way to go. If you go this way, just remove the -y section of the command line.

The registry file makes an association for all of the dump variants, including reflected dumps (*.ini). Reflected dumps can be made using ProcDump with the -r switch (e.g. procdump.exe -r -ma notepad.exe). Currently, I piggy back on the Visual Studio 2010 keys so as to get an icon, and still support opening dumps in Visual Studio via the Open entry (I have no idea why you would want to do that though).

The other thing I do is load the debugger extensions that I commonly use. In this (example) registry file, I just include one of my own extensions (myext.dll) via the -a switch (the extension I made for the MSDN Magazine Debugging API series). If you want to load more, you just include multiple -a myext.dll entries in the command line. (Side note, if you are doing the same with cdb, you can't have a space between -a and the dll name). In my personal version of this, I load six extensions.

One thing you may want to consider is adding the -WX switch to ignore the default workspace. I personally set up the default workspace the way I like it (command window docked, WinDbg maximized on my main monitor, font colors set for each text type, etc.) and use this as a template for each new debug session. As such, I don't want the -WX switch (that's a double negative) as I want the workspace to apply. If you however want to use the 'out of box' defaults always, add the -WX switch.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.dmp]
@="VisualStudio.dmp.10.0"

[HKEY_CLASSES_ROOT\.hdmp]
@="VisualStudio.dmp.10.0"

[HKEY_CLASSES_ROOT\.mdmp]
@="VisualStudio.dmp.10.0"

[HKEY_CLASSES_ROOT\.kdmp]
@="VisualStudio.dmp.10.0"

[HKEY_CLASSES_ROOT\.ini]
@="VisualStudio.dmp.10.0"

[HKEY_CLASSES_ROOT\VisualStudio.dmp.10.0\shell]
@="WinDbg_x64_public"

[HKEY_CLASSES_ROOT\VisualStudio.dmp.10.0\shell\WinDbg_x86_public]
@="Open with WinDbg x86 (Public)"

[HKEY_CLASSES_ROOT\VisualStudio.dmp.10.0\shell\WinDbg_x86_public\Command]
@="\"C:\\Debuggers_x86\\windbg.exe\" -z \"%1\" -a myext.dll -y \"SRV*C:\\Symbols*http://msdl.microsoft.com/download/symbols\""

[HKEY_CLASSES_ROOT\VisualStudio.dmp.10.0\shell\WinDbg_x64_public]
@="Open with WinDbg x64 (Public)"

[HKEY_CLASSES_ROOT\VisualStudio.dmp.10.0\shell\WinDbg_x64_public\Command]
@="\"C:\\Debuggers\\windbg.exe\" -z \"%1\" -a myext.dll -y \"SRV*C:\\Symbols*http://msdl.microsoft.com/download/symbols\""

WinDbg Support

I've always known that WinDbg had a -I (that's a capital i) switch to set it as the (automatic) postmortem debugger. This follows in the Dr.Watson footsteps that has the same option. Of interest here, you can do this association twice on 64bit versions of Windows (running -I on the x86 and x64 debugger versions of WinDbg). By setting it twice, the x64 debugger is used for x64 failures (via the HKLM AeDebug key) and the x86 debugger is used for x86 failures (via the HKLM WOW64 AeDebug key). (Handy for those architecture agnostic extension issues.)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug

Note, there is no built-in way to revert the -I setting to the WER default. Maarten van de Bospoort has posted about this previously. You need to resort to a backup of the keys (i.e. export them prior to the running of WinDbg -I).

So what happened today to prompt me to write this post?

Today, I discovered that WinDbg can do file association too! WinDbg.exe supports a -IA switch to register the file associations. Both the -I and -IA options are both listed in the Debugger.chm file for the WinDbg command line topic; but the description is a little brief for -IA.

So as to find out what -IA actually does, I recorded it's execution with ProcMon. Running WinDbg.exe -IA elevated from c:\debuggers produces the following screenshot and ProcMon log file (lots of filtering has been applied).

8:21:12.7253212 PM windbg.exe 7140 RegOpenKey HKCR\.dmp SUCCESS Desired Access: Read, Maximum Allowed
8:21:12.7254430 PM windbg.exe 7140 RegCreateKey HKCR\.dmp SUCCESS Desired Access: All Access
8:21:12.7255690 PM windbg.exe 7140 RegQueryKey HKCR\.dmp SUCCESS Query: Name
8:21:12.7256082 PM windbg.exe 7140 RegQueryKey HKCR\.dmp SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7257391 PM windbg.exe 7140 RegSetValue HKCR\.dmp\(Default) SUCCESS Type: REG_SZ, Length: 36, Data: WinDbg.DumpFile.1
8:21:12.7265370 PM windbg.exe 7140 RegOpenKey HKCR\.hdmp SUCCESS Desired Access: Read, Maximum Allowed
8:21:12.7266420 PM windbg.exe 7140 RegCreateKey HKCR\.hdmp SUCCESS Desired Access: All Access
8:21:12.7275875 PM windbg.exe 7140 RegQueryKey HKCR\.hdmp SUCCESS Query: Name
8:21:12.7276288 PM windbg.exe 7140 RegQueryKey HKCR\.hdmp SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7277548 PM windbg.exe 7140 RegSetValue HKCR\.hdmp\(Default) SUCCESS Type: REG_SZ, Length: 36, Data: WinDbg.DumpFile.1
8:21:12.7282217 PM windbg.exe 7140 RegOpenKey HKCR\.mdmp SUCCESS Desired Access: Read, Maximum Allowed
8:21:12.7283812 PM windbg.exe 7140 RegCreateKey HKCR\.mdmp SUCCESS Desired Access: All Access
8:21:12.7284834 PM windbg.exe 7140 RegQueryKey HKCR\.mdmp SUCCESS Query: Name
8:21:12.7285233 PM windbg.exe 7140 RegQueryKey HKCR\.mdmp SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7286521 PM windbg.exe 7140 RegSetValue HKCR\.mdmp\(Default) SUCCESS Type: REG_SZ, Length: 36, Data: WinDbg.DumpFile.1
8:21:12.7291973 PM windbg.exe 7140 RegCreateKey HKCR\.kdmp SUCCESS Desired Access: All Access
8:21:12.7307581 PM windbg.exe 7140 RegQueryKey HKCR\.kdmp SUCCESS Query: Name
8:21:12.7307980 PM windbg.exe 7140 RegQueryKey HKCR\.kdmp SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7309261 PM windbg.exe 7140 RegSetValue HKCR\.kdmp\(Default) SUCCESS Type: REG_SZ, Length: 36, Data: WinDbg.DumpFile.1
8:21:12.7332358 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.DumpFile.1 SUCCESS Desired Access: All Access
8:21:12.7349016 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1 SUCCESS Query: Name
8:21:12.7349436 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1 SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7350913 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.DumpFile.1\(Default) SUCCESS Type: REG_SZ, Length: 58, Data: WinDbg Post-Mortem Dump File
8:21:12.7373303 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1 SUCCESS Query: Name
8:21:12.7373793 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1 SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7377440 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.DumpFile.1\DefaultIcon SUCCESS Desired Access: All Access
8:21:12.7388456 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\DefaultIcon SUCCESS Query: Name
8:21:12.7388848 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\DefaultIcon SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7390150 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.DumpFile.1\DefaultIcon\(Default) SUCCESS Type: REG_SZ, Length: 64, Data: "C:\debuggers\windbg.exe",-3002
8:21:12.7467553 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1 SUCCESS Query: Name
8:21:12.7474203 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1 SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7477828 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.DumpFile.1\shell SUCCESS Desired Access: All Access
8:21:12.7511046 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell SUCCESS Query: Name
8:21:12.7511515 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7513244 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.DumpFile.1\shell\(Default) SUCCESS Type: REG_SZ, Length: 10, Data: Open
8:21:12.7540113 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell SUCCESS Query: Name
8:21:12.7540540 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7544075 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.DumpFile.1\shell\Open SUCCESS Desired Access: All Access
8:21:12.7556393 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell\Open SUCCESS Query: Name
8:21:12.7556785 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell\Open SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7558143 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.DumpFile.1\shell\Open\(Default) SUCCESS Type: REG_SZ, Length: 12, Data: &Open
8:21:12.7576306 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell\Open SUCCESS Query: Name
8:21:12.7576775 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell\Open SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7580456 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.DumpFile.1\shell\Open\command SUCCESS Desired Access: All Access
8:21:12.7592768 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell\Open\command SUCCESS Query: Name
8:21:12.7593167 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.DumpFile.1\shell\Open\command SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7594629 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.DumpFile.1\shell\Open\command\(Default) SUCCESS Type: REG_SZ, Length: 68, Data: "C:\debuggers\windbg.exe" -z "%1"
8:21:12.7630360 PM windbg.exe 7140 RegCreateKey HKCR\.wew SUCCESS Desired Access: All Access
8:21:12.7641811 PM windbg.exe 7140 RegQueryKey HKCR\.wew SUCCESS Query: Name
8:21:12.7642168 PM windbg.exe 7140 RegQueryKey HKCR\.wew SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7644407 PM windbg.exe 7140 RegSetValue HKCR\.wew\(Default) SUCCESS Type: REG_SZ, Length: 38, Data: WinDbg.Workspace.1
8:21:12.7677107 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.Workspace.1 SUCCESS Desired Access: All Access
8:21:12.7688110 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1 SUCCESS Query: Name
8:21:12.7688488 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1 SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7690853 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.Workspace.1\(Default) SUCCESS Type: REG_SZ, Length: 44, Data: WinDbg Workspace File
8:21:12.7708855 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1 SUCCESS Query: Name
8:21:12.7709275 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1 SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7712446 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.Workspace.1\DefaultIcon SUCCESS Desired Access: All Access
8:21:12.7722720 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\DefaultIcon SUCCESS Query: Name
8:21:12.7723098 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\DefaultIcon SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7724169 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.Workspace.1\DefaultIcon\(Default) SUCCESS Type: REG_SZ, Length: 64, Data: "C:\debuggers\windbg.exe",-3002
8:21:12.7742535 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1 SUCCESS Query: Name
8:21:12.7742990 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1 SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7746364 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.Workspace.1\shell SUCCESS Desired Access: All Access
8:21:12.7784159 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell SUCCESS Query: Name
8:21:12.7784565 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7785895 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.Workspace.1\shell\(Default) SUCCESS Type: REG_SZ, Length: 10, Data: Open
8:21:12.7806080 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell SUCCESS Query: Name
8:21:12.7806528 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7809825 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.Workspace.1\shell\Open SUCCESS Desired Access: All Access
8:21:12.7821576 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell\Open SUCCESS Query: Name
8:21:12.7821933 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell\Open SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7823025 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.Workspace.1\shell\Open\(Default) SUCCESS Type: REG_SZ, Length: 12, Data: &Open
8:21:12.7840075 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell\Open SUCCESS Query: Name
8:21:12.7840460 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell\Open SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7856271 PM windbg.exe 7140 RegCreateKey HKCR\WinDbg.Workspace.1\shell\Open\command SUCCESS Desired Access: All Access
8:21:12.7869639 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell\Open\command SUCCESS Query: Name
8:21:12.7870052 PM windbg.exe 7140 RegQueryKey HKCR\WinDbg.Workspace.1\shell\Open\command SUCCESS Query: HandleTags, HandleTags: 0x0
8:21:12.7871508 PM windbg.exe 7140 RegSetValue HKCR\WinDbg.Workspace.1\shell\Open\command\(Default) SUCCESS Type: REG_SZ, Length: 70, Data: "C:\debuggers\windbg.exe" -WF "%1"

The context menu registered using the same technique as my regsitry file - it uses shell commands in the HKCR hive.

The dump associations aren't as useful as my registry file as only one debugger is supported and it skips *.ini files, but it does however associate the workspace files. I've personally never opened a workspace, but if you have, this might be a good thing to have.

So what will I be doing on my systems from now on?

I'll be running WinDbg.exe -IA against my x64 debugger, I'll then run WinDbg.exe -I against the x64 and x86 debugger, and then I'll run my registry script to give me more flexibility (and file type support) in the way that dumps are loaded.

BTW, if after doing this you find that you aren't getting the context menu, the odds are that you have a 'Open With...' file association in your HKCU hive. Find the .dmp key and delete it to revert to the global HKCR configuration.

Note, if you have no intention of debugging the AeDebug dumps, you are much better off leaving WER as the postmortem debugger (i.e. don't run -I) and sending the issue to Microsoft for analysis. Its the best way of getting the issue fixed.

ProcDump v3.04 - a cautionary MiniPlus update

AndrewRichards — Thu, 05 May 2011 02:26:35 GMT

ProcDump v3.04 has been released. The release just contains a tiny (edge case) sanity check I wrote in the MiniPlus stack traversal code. Specifically, it caters for the case where esp/rsp is not within the stack base and stack limit. In this highly unlikely scenario, ProcDump -mp now iterates between the stack limit and the base instead of between the stack pointer and the base.

David Solomon Memory Management talks

AndrewRichards — Sun, 01 May 2011 17:50:01 GMT

These David Solomon talks on Memory Management (circa 2005) used to be on TechNet Spotlight but got pulled last year.

I've found a repost of them here: http://www.opsvault.com/david-solomon-technet-talks/

Writing a 'Debugging Tools for Windows' Extension

AndrewRichards — Sat, 23 Apr 2011 17:50:00 GMT

I've written a three part series in MSDN Magazine that covers the Debugging API (specifically, DbgEng).

Writing a Debugging Tools for Windows Extension - Part 1 - March 2011

Covers the build environment and the basics of Output, reading Memory and reading Registers

Web: http://msdn.microsoft.com/en-us/magazine/gg650659.aspx
PDF: http://download.microsoft.com/download/4/D/4/4D40CAFF-528D-4AAF-80AA-2DD524A22BD2/MSDN_0311DG.pdf

Writing a Debugging Tools for Windows Extension - Part 2 - May 2011

Covers the how of Debugger Markup Language (DML)

Web: http://msdn.microsoft.com/en-us/magazine/hh148143.aspx
PDF: http://download.microsoft.com/download/0/5/7/057B35F0-6EF1-4E27-AE3A-9E7FD2060A63/MSDN_0511DG.pdf

Writing a Debugging Tools for Windows Extension - Part 3 - June 2011

Covers the how and why to use Debugger Clients and Debugger Output Callbacks

Web: http://msdn.microsoft.com/en-us/magazine/hh205613.aspx
PDF: http://download.microsoft.com/download/8/F/3/8F3FC55F-AB8F-4F1C-88CB-844901839517/MSDN_Magazine_0611.pdf

Linked List Performance Issues? Skip List to the Rescue!

AndrewRichards — Fri, 22 Apr 2011 05:25:00 GMT

A Traditional Linked List

At some point in every developer’s life, you’ll have to write some code that works with a Linked List. You’ll start by making a structure like this:

typedef struct
{
ULONG64 ulStartAddress;
ULONG64 ulEndAddress;
MemoryNode* pNext;
} MemoryNode;

And you’ll populate it… (In this example, I’m using the DbgEng API to iterate over a target address space for memory regions.)

After that, you’ll want to interact with the linker list, usually in a search type fashion.

HRESULT Search(MemoryNode* pNodeRoot, MemoryNode** ppNode, ULONG64 addr)
{
if ((pNodeRoot == NULL) || (ppNode == NULL))
    return E_INVALIDARG;

*ppNode = NULL;

ULONG64 ulPtr = 0;
MEMORY_BASIC_INFORMATION64 memInfo;
MemoryNode* pNode = pNodeRoot;
while (pNode != NULL)
{
    if ((addr >= pNode->ulStartAddress) && (addr <= pNode->ulEndAddress))
    {
      *ppNode = pNode;
      return S_OK;
    }

    if (addr < pNode->ulStartAddress)
    { // We have passed the point where it can be as the list is in order
      break;
    }
    pNode = pNode->pNext;
}
return S_FALSE;
}

The problem is, this code can run quite slow. For example, lets say that we modeled 200,000 memory regions. (As you can probably guess, yes, this is based on a personal real-world observation). And lets say that you wanted to mark each a region that contains a particular address as being ‘used’. In a worse case scenario, you would need to traverse 200,000 pNext pointers to find out the region doesn’t exist (e.g. you search for 0xffffffff’ffffffff). That’s really expensive if you need to do the search 100,000+ times (e.g. for every pointer in a stack – 1Mb/8). That’s a total of 200,000,000,000 (200 trillion) comparison operations!

The interesting thing about this linked list is that it is ordered by virtue of the way it was built, and it will not experience any type of insertion or deletion after its creation. If you have a Linked List like this, a Skip List can be use to help speed up searches considerably!

Skip List

A Skip List works the same way as the various tokens work in the board game Scotland Yard. You jump a great distance with the Underground (train) tokens, a few streets with the Bus tokens, and then individual streets with the Taxi tokens. By keeping additional ‘Next’ pointers to varying distances forward in the list, you can ‘skip’ past a huge number of nodes with just a few jumps.

The trick is to work out the number of skip pointers to have versus the cost of checking each skip pointer in each destination reached. If you take this to the n’th degree, you could have 200,000 skip pointers per node (as per my example), but it it would cost 199,999 ‘if-then’ statements to determine that you only need to skip forward one node (in the worse case) – the last statement being the only ‘if-then’ statement that succeeds.

Some basic math generates a pretty good idea of the size of the jump you’ll get by having N skip pointers (there is no real mathematical theorem here behind what the size of the jumps should be – I’m just using even size jumps as that seems a good way of making an ‘average’ approach). What you do is, get the expected data set size (in my case, somewhere between 10,000 and 1,000,000 nodes) and calculate the square, cube and quad roots of the highest value.

1,000,000 Square Root = 1,000x1,000 | Worse Case = ~ 1,000+1,000 = ~2,000
1,000,000 Cube Root = 100x100x100 | Worse Case = ~ 100+100+100 = ~300
1,000,000 Quad Root = 32x32x32x32 | Worse Case = ~ 32+32+32+32 = ~128

The approximate worse-case cost is the sum of the jump sizes. So if you need to traverse 1,000,000 nodes to the last node, it would take 1million jumps if you have 1 skip (next) pointer, ~2,000 jumps if you have 2 skip pointers (0.2% cost), ~300 if you have 3 skip pointers (0.03% cost), and ~128 if you have 4 skips pointers (0.01% cost). At a certain point, the increase in the number of skip pointers passes the benefit of adding them. In the case of 1,000,000 the magic number is around 9 (I think), but the benefits are seen around 3 or 4.

Now my math isn’t very accurate as it hasn’t accounted for the conditional statements that fail along the way. That is, when you get to the last big jump, you check for this jump in all subsequent sub-nodes. Thus the cost is more like this (I think):

1,000,000 Square Root = 1,000x1,000 | Worse Case = (1,000)+(1,000+999) = 2,999
1,000,000 Cube Root = 100x100x100 | Worse Case = (100)+(100+99)+(100+99+99) = 597
1,000,000 Quad Root = 32x32x32x32 | Worse Case = (32)+(32+31)+(32+31+31)+(32+31+31+31) = 314
1,000,000 Quin Root = 16x16x16x16x16 | Worse Case = (16)+(16+15)+(16+15+15)+(16+15+15+15)+(16+15+15+15+15) = 230

The savings are still huge. And from experience, I can tell you that this reduced my application’s search from 20 minutes to under 100 msec. Compared to B-Tree storage, you’ll get a faster search, plus you don’t have to worry about rebalancing the tree to solve the right-tree only insertion issue (which you’ll get with linear data insertion).

So what does the code now look like?

Here’s the modified structure using 4 jump pointers:

typedef struct
{
ULONG64 ulStartAddress;
ULONG64 ulEndAddress;
Node* pNext4; // Skips 32k forward
Node* pNext3; // Skips 1k forward
Node* pNext2; // Skips 32 forward
Node* pNext1; // Skips 1 forward
} MemoryNode;

Here’s the modified list builder using 4 jump pointers:

HRESULT LoopMemInfo(IDebugDataSpaces2* pDebugDataSpaces2, MemoryNode** ppNodeRoot)
{
if ((pDebugDataSpaces2 == NULL) || (ppNodeRoot == NULL))
    return E_INVALIDARG;

*ppNodeRoot = NULL;

ULONG64 ulPtr = 0;
MEMORY_BASIC_INFORMATION64 memInfo;
MemoryNode* pPrev4 = NULL;
MemoryNode* pPrev3 = NULL;
MemoryNode* pPrev2 = NULL;
MemoryNode* pPrev1 = NULL;
ULONG64 ulCount = 0;
while (SUCCEEDED(pDebugDataSpaces2->QueryVirtual(ulPtr, &memInfo)))
{
    MemoryNode* pNode = new MemoryNode;
    if (ulCount == 0)
    {
       *ppNodeRoot = pNode;
       pPrev1 = pNode;
       pPrev2 = pNode;
       pPrev3 = pNode;
       pPrev4 = pNode;
    }

    if (ulCount >= 1) { pPrev1->pNext1 = pNode; pPrev1 = pPrev1->pNext1; }
    if (ulCount >= 32) { pPrev2->pNext2 = pNode; pPrev2 = pPrev2->pNext1; }
    if (ulCount >= 1024) { pPrev3->pNext3 = pNode; pPrev3 = pPrev3->pNext1; }
    if (ulCount >= 32768) { pPrev4->pNext4 = pNode; pPrev4 = pPrev4->pNext1; }

    pNode->ulStartAddress = memInfo.BaseAddress;
    pNode->ulEndAddress = memInfo.BaseAddress + memInfo.RegionSize;
    pNode->pNext4 = NULL;
    pNode->pNext3 = NULL;
    pNode->pNext2 = NULL;
    pNode->pNext1 = NULL;
    ulPtr = memInfo.BaseAddress + memInfo.RegionSize;
    ulCount++;
}
return S_OK;
}

Here’s the modified search using 4 jump pointers:

HRESULT Search(MemoryNode* pNodeRoot, MemoryNode** ppNode, ULONG64 addr)
{
if ((pNodeRoot == NULL) || (ppNode == NULL))
    return E_INVALIDARG;

*ppNode = NULL;

MEMORY_BASIC_INFORMATION64 memInfo;
MemoryNode* pNode = pNodeRoot;
while (pNode != NULL)
{
    if ((pNode->pNext4 != NULL) && (addr >= pNode->pNext4->ulStartAddress))
    {
      pNode = pNode->pNext4;
      continue;
    }

    if ((pNode->pNext3 != NULL) && (addr >= pNode->pNext3->ulStartAddress))
    {
      pNode = pNode->pNext3;
      continue;
    }

    if ((pNode->pNext2 != NULL) && (addr >= pNode->pNext2->ulStartAddress))
    {
      pNode = pNode->pNext2;
      continue;
    }

    if ((pNode->pNext1 != NULL) && (addr >= pNode->pNext1->ulStartAddress))
    {
      pNode = pNode->pNext1;
      continue;
    }

    if ((addr >= pNode->ulStartAddress) && (addr <= pNode->ulEndAddress))
    {
      *ppNode = pNode;
      return S_OK;
    }

    // We haven’t found it based on our knowledge of the list order
    break;
}
return S_FALSE;
}

* Note: I just typed this code off the top of my head; I’ve never compiled or tested it. It could have bugs in it. No warranty of any type is given for its use.

So there you have it, an example implementation of a Skip List. Note though, there are lots of caveats to its use:

The data being modeled needs to linear
The data being modeled needs to comparable
Insertion is done all-at-once (so the cost of generating the pointers is low)
An unconstrained amount of memory is available (you can afford the cost of the additional pointers)

Skips Lists are a simple concept, and aren’t too hard implement. I’d love to hear about your success stories. They fixed a massive performance problem within my own code without causing too much disruption to the applications linked-list design.

IDebugDataSpaces2::QueryVirtual doesn’t act the same as VirtualQuery

AndrewRichards — Thu, 21 Apr 2011 02:58:00 GMT

One of my debugger extensions commands uses IDebugDataSpaces2::QueryVirtual to iterate through the target’s address space to find particular size allocations (regions that are used for the TEB if you must know). The code was working fine but on x64 dumps, I found that it was running quite slow.

Looking in to it, I found out that IDebugDataSpaces2::QueryVirtual doesn’t act the same as VirtualQuery. When it encounters an area that doesn’t contain an allocation, it doesn’t return a MEM_FREE ‘State’ value in the MEMORY_BASIC_INFORMATION64 structure for the region (like VirtualQuery does), instead it jumps forward to the next region. Thus the pointer provided may not be in the region returned.

In my code, I had this iterator:

ulPtr += memInfo.RegionSize;

I was only using a 0x1800 byte increment because that was the size of the region jumped to. The performance problem stemmed from the size of the jump, from a Base Address of 0x13’00000000 to 0xffffff1e’00000000. Needless to say, it took a while to traverse between the two (over 30 seconds).

A quick change to this solved everything:

ulPtr = memInfo.BaseAddress + memInfo.RegionSize;

Here is how to correctly do a Lookup and how to do a Loop.

/////////////////////////////////////
// Lookup
/////////////////////////////////////

HRESULT GetMemInfo(IDebugDataSpaces2* pDebugDataSpaces2, ULONG64 ulPtr, MEMORY_BASIC_INFORMATION64* pMemInfo)

{
if ((pDebugDataSpaces2 == NULL) || (pMemInfo == NULL))
return E_INVALIDARG;

MEMORY_BASIC_INFORMATION64 memInfo;
if (SUCCEEDED(pDebugDataSpaces2->QueryVirtual(ulPtr, &memInfo)))
{
    if ((ulPtr >= memInfo.BaseAddress) &&
        (ulPtr < (memInfo.BaseAddress+memInfo.RegionSize)))
    {
      memcpy(pMemInfo, &memInfo, sizeof(MEMORY_BASIC_INFORMATION64));
      return S_OK;
    }
}
return E_FAIL;
}

/////////////////////////////////////
// Loop
/////////////////////////////////////

HRESULT LoopMemInfo(IDebugDataSpaces2* pDebugDataSpaces2)
{
if (pDebugDataSpaces2 == NULL)
return E_INVALIDARG;

ULONG64 ulPtr = 0;

MEMORY_BASIC_INFORMATION64 memInfo;

while ((ulPtr != 0) && (SUCCEEDED(pDebugDataSpaces2->QueryVirtual(ulPtr, &memInfo))))
{
    // Note, ulPtr may not be within the memory region!
    // ...
    ulPtr = memInfo.BaseAddress + memInfo.RegionSize;
}
return S_OK;
}

/////////////////////////////////////

StackBase and StackLimit offsets

AndrewRichards — Wed, 20 Apr 2011 23:00:00 GMT

To save a symbol lookup in a debugger extension, here are the hardcodes to use for StackBase and StackLimit.

User Mode 32bit

0:000> dt nt!_TEB.Stack*

ntdll!_TEB

+0x000 NtTib :

+0x004 StackBase : Ptr Void

+0x008 StackLimit : Ptr Void

User Mode 64bit

0:000> dt nt!_TEB NtTib.Stack*

ntdll!_TEB

+0x000 NtTib :

+0x008 StackBase : Ptr64 Void

+0x010 StackLimit : Ptr64 Void

Kernel Mode 32bit

0:000> dt nt!_KTHREAD Stack*

ntdll!_KTHREAD

+0x01c StackLimit : Ptr Void (NT v5.0 - Windows 2000)

+0x01c StackLimit : Ptr Void (NT v5.1 - Windows XP SP3)

+0x01c StackLimit : Ptr Void (NT v5.2 - Windows 2003 SP2)

+0x02c StackLimit : Ptr Void (NT v6.0 - Windows Vista/2008)

+0x02c StackLimit : Ptr Void (NT v6.1 - Windows 7/2008R2)

+0x15c StackBase : Ptr Void (NT v5.0 - Windows 2000)

+0x15c StackBase : Ptr Void (NT v5.1 - Windows XP SP3)

+0x158 StackBase : Ptr Void (NT v5.2 - Windows 2003 SP2)

+0x174 StackBase : Ptr Void (NT v6.0 - Windows Vista/2008)

+0x194 StackBase : Ptr Void (NT v6.1 - Windows 7/2008R2)

Kernel Mode 64bit

0:000> dt nt!_KTHREAD Stack*

ntdll!_KTHREAD

+0x??? StackLimit : Ptr64 Void(NT v5.1 - Windows XP SP3)

+0x??? StackLimit : Ptr64 Void(NT v5.2 - Windows 2003 SP2)

+0x030 StackLimit : Ptr64 Void(NT v6.0 - Windows Vista/2008)

+0x030 StackLimit : Ptr64 Void(NT v6.1 - Windows 7/2008R2)

+0x??? StackBase : Ptr64 Void(NT v5.1 - Windows XP SP3)

+0x??? StackBase : Ptr64 Void(NT v5.2 - Windows 2003 SP2)

+0x250 StackBase : Ptr64 Void(NT v6.0 - Windows Vista/2008)

+0x278 StackBase : Ptr64 Void(NT v6.1 - Windows 7/2008R2)