Windbg scripts, debugging and troubleshooting tools and techniques to help you isolate software problems.
Translate This Page
Translate this page
Just For Fun
Browse by Tags
Tagged Content List
New Debugging Book – Windows Debugging Notebook: Essential User Space WinDbg Commands
A reference book for technical support and escalation engineers troubleshooting and debugging complex software issues. The book is also invaluable for software maintenance and development engineers debugging Windows applications and services. Do you want to know more about this book? Check out...
29 Sep 2011
Special Command—Using .dump/.dumpcab to Get Dumps and Symbols from Production Servers
Using WinDbg you can create a dump file from an application running, for instance, in a production server. After collecting the dump file, you can load it in another machine and debug it. However, to be more effective during your debugging session you need symbols . Thus, thinking about it, here's the...
15 Sep 2009
Special Command—Using !chksym/!itoldyouso to Check PDB Files Against Modules
These are two debugger extensions that are used to see the PDB file that matches a specific module. Note that !itoldyouso is not documented. The output of both commands is identical. Usage: 0:025> !chksym ntdll ntdll.dll Timestamp: 49EEA706 SizeOfImage: 180000 pdb: wntdll...
4 Sep 2009
Special Command—Using !for_each_frame to Run Commands
!for_each_frame is a favorite among debuggers. It's a very flexible and powerful command that enables you to run commands for each frame of the call stack. You can use basically any command. For instance, let’s say you want to see all local variables from each frame of a specific stack. Of course...
19 Aug 2009
Special Command—Peeking Memory Addresses Using !address
Let’s say that you get a memory address and you want to know if it’s from the heap, the stack, or someplace else. Or yet, let’s say you have a .NET application consuming lots of memory, and you want to get a better understanding of this memory consumption. The !address command is helpful in both situations...
17 Mar 2009
Special Command—Parsing Strings, Files, and Commands Output Using .foreach
This is by far one of the most powerful WinDbg commands. Even if you don’t create scripts, you’ll benefit from this command. It’s powerful because it’s flexible. You can use it for a huge variety of operations. The .foreach token parses the output of one or more debugger commands and uses each...
11 Mar 2009
Special Command—Parsing Commands Using .shell
Finally I’m writing about this command. I love it! It’s so powerful! .shell command launches a shell process and redirects its output to the debugger or to a specified file. Usage: .shell [ Options ] [ ShellCommand ] .shell -i InFile [ -o OutFile [ -e ErrFile ]] [ Options ] ShellCommand According...
19 Feb 2009
[PowerShell Script] Downloading PDB for Specific Modules
A few weeks ago, during a laboratory with a customer, I found myself struggling to download the public symbol from a specific driver. Since driver is Kernel Mode if you get a User Mode dump from the application using the driver, you won’t be able to actually see and download the driver. If you have a...
8 Aug 2008
Special Command—Listing the Nearest Symbols with ln
ln is a very useful command. It stands for list nearest. You provide an address as argumen t, and it gives you the closest symbol that matches the address. Of course, you have to be using the right symbols! Here is the syntax : ln [ address ] Example: Tip: You can see if...
10 Jun 2008
Special Command—Extracting Class and Struct Fields Using dt
dt is another command used almost all the time whenever you want to get the fields and type for a structure or class. For example, you may have a this pointer and use dt to get its fields and type. It’s a simple command with interesting variations that you should be aware of, because it’s an important...
21 Apr 2008
Special Command: Using s to Explore The Memory
Very often I found myself scanning the stack or the entire virtual memory for the process to find information that may help me. This information may be strings, DWORDS, bytes, chars, etc… To accomplish this you should use the s command. Here I exemplify how you can use it to scan the memory...
11 Mar 2008
Special Command: Advanced Symbol Searching Using x.
This is yet another command that has powerful capabilities. It’s very flexible, too. You can use different parameter s combinations; though, I recommend you look at or check the WinDbg documentation if you want to explore other variations. Again I’m going to show you the variations I use most of...
2 Mar 2008
Page 1 of 1 (12 items)
© 2013 Microsoft Corporation.
Privacy & Cookies