Windbg: debugging commands

By -
1.     !thread/!process [address] e - on x64 will not show you the meaningless Args to Child information.
2.     .frame /c [FrameNumber] - sets context to specificied stack frame. On x64 provides more reliable register information than .trap.
3.     kn - Dumps call stack with frame numbers, easier than counting stacks for .frame.
4.     .frame /r [FrameNumber] - same as .frame /c, but shows registers without changing context.Note: With .frame /c or /r you can only trust the nonvolatile registers. 
5.     k=rbp rip FrameCount - Dumps call stack starting at rbp/rip on x64. Useful when the stack is corrupt.
6.     .process/.thread /p /r [address] - sets new process context, sets .cache forcedecodeuser, and reloads user symbols.
7.     !process [address] 17 - Sets the context for this command, avoids the need for .process to see user stacks. Try !process 0 17
8.     ~~[ThreadID]s - Changes threads in user mode. Use Thread ID number from output such as !locks. Ex: ~~[1bd4]s
9.     !heap -p -a <address> - Shows information about the heap block containing <address>, even if you aren't using pageheap.
10.   ub - Unassembles starting at a location prior to your address. Accepts l<number> to specify how many instructions to go back. ub . l20
11.   !stacks 2 [FilterString] - Finds kernel mode call stacks that contain the FilterString in a symbol.
12.   !thread [address] 17 (or 1e on x64) - Sets context for this command, avoids the need for .thread/.process for user stacks.
13.   .hh [Text] - Opens the debugger help. [Text] is the topic to lookup in the index. Example: .hh !pte
14.   ?? can dump structs using C++ style expressions. Ex: ??((nt!_KTHREAD*)(0xfffffa800ea43bb0))->ApcState
15.   bp /t EThread - Sets a kernel mode breakpoint that only triggers when hit in the context of this thread.
16.   bp /p EProcess - Sets a kernel mode breakpoint that only triggers when hit in the context of this process.
17.   gc - If you run 'p' and hit a breakpoint, gc takes you where p would have gone if you had not hit the bp.
18.   gu - Go until the current function returns. Effectively this unwinds one stack frame. #windbg
19.   pc - Steps through until the next 'call' instruction. Combine with other commands to find who returned your error> pc;p;r eax
20.   pt - Steps through until the next 'ret' instruction. Similar to gu, but pt stops on the ret and gu stops after the ret.
21.   .ignore_missing_pages 1 - supresses the error: "Page 2a49 not present in the dump file. Type ".hh dbgerr004" for details"
22.   .exr -1 shows the most recent exception. Useful in user dumps of crashes, especially for no execute crashes (NX/DEP).
23.   wt - Trace calls until they return to the current address. More useful with -or to get return values. Use -l for depth.
24.   .thread /w - Changes to the WOW64 32-bit context from 64-bit kernel mode. Wow64exts doesn't work in kernel mode.
25.   ??sizeof(structure) - Gets the size of a structure, it's easier than counting.
26.   sxe ld:module.dll - Enables an exception which will break into the debugger when module.dll is loaded.
27.   vertarget - Shows OS version of the debug target. Also shows machine name, uptime, and session time (when the dump was taken).
28.   !vm 1 - In a kernel debugger, shows basic information about memory usage. Available, committed, pagefile, pool, sysptes, etc.
29.   .time - Shows session time (when dump was taken) and system uptime. In user mode shows process uptime, kernel/user time.
30.   ba w size [address] - Break on write access only. Replace size with the num bytes you want to watch. Ex: ba w 4 005d5f10
31.   .process -i <address> - Make the process active and break into the debugger. Use in live kernel debugs to get into process context.
32.   .reload /f /o - Overwrites cached files in your downstream symbol store. Useful when your store has corrupt pdbs.
33.   ->* - Use with dt to dump pointers. Example: dt _EPROCESS [Address] ObjectTable->*
34.   !for_each_module s -a @#Base @#End "PTag" - Find the drivers using pool tag "PTag".
35.   .unload [DllName] - Unloads the debug extension you didn't intend to load. Omit DllName to unload the last dll loaded.
36.   !exqueue dumps the executive worker queues. Use flags 7f to dump the worker threads and the queues.
37.   lmvm <module> - Dumps information about the module. Remember to use <module> and not <module.dll>.
38.   !thread -t TID - Dump a thread using thread ID rather than thread address. Useful when working with a critical section.
39.   !list - Walks a linked list and displays informatino for each element in a list. See blog later today for an example.
40.   .time -h # - Shows the debug session time using the timezone offset of #. Ex: .time -h 0 shows when a dump was taken in UTC.
41.   !session - Lists all of the user session IDs. A quick way to list the active sessions from a dump of a terminal server.
42.   !session -s SessionID - Changes the current session context to SessionID. Useful when looking at GDI, or other per session data.
43.   | ProcNum s - Switches to process number ProcNum. Use when debugging multiple dumps, or processes, in one windbg.
44.   !! - Launches a shell process and redirects its output to the debugger. The same as .shell, but "bang bang" sounds cooler.
45.   uf Function - Dumps the assembly for Function (name or address). Useful for optimized code that is not contiguous in memory.
46.   uf /c Function - Shows all of the calls made by Function (can be function name or address).
47.   !wow64exts.sw - switches between x64 and x86 contexts. Often used to reverse .thread /w context switch.

Comments

Post a Comment

Popular posts from this blog

Boot configuration Data Store --BCDEdit /set

By -
The  BCDEdit /set  command sets a boot entry option value in the Windows boot configuration data store (BCD). Use the  BCDEdit /set  command to configure specific boot entry elements, such as kernel debugger settings, data execution protection (DEP) and processor address extension (PAE) options, and to load alternate hardware abstraction layer (HAL) and kernel files. You can use these boot entry options when you are testing and debugging your driver for Windows Vista, Windows 7, and later versions of Windows. bcdedit /set [{ID}] datatype value Parameters [ { ID }] The  { ID }  is the GUID that is associated with the boot entry. If you do not specify an  { ID } , the command modifies the current operating system boot entry. If a boot entry is specified, the GUID associated with the boot entry must be enclosed in braces  { } . To view the GUID identifiers for all of the active boot entries, use the  bcdedit /enum  command. datatype value The fol
Read more

ADSI Edit

By -
Image
ADSI Edit (adsiedit.msc) Updated: March 19, 2010 Applies To: Windows SBS 2008, Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows Server 2008 R2 Active Directory® Service Interfaces Editor (ADSI Edit) is a Lightweight Directory Access Protocol (LDAP) editor that you can use to manage objects and attributes in Active Directory. ADSI Edit (adsiedit.msc) provides a view of every object and attribute in an Active Directory forest. You can use ADSI Edit to query, view, and edit attributes that are not exposed through other Active Directory Microsoft Management Console (MMC) snap-ins: Active Directory Users and Computers, Active Directory Sites and Services, Active Directory Domains and Trusts, and Active Directory Schema. This topic includes the following sections: Installing ADSI Edit Using ADSI Edit
Read more

Userenv logging (User Environment logging)

By -
When you enable userenv logging, you can perform debug logging of the user profile and the system policy processes. Userenv log files also contain information about the status of each Group Policy extension, such as Application Deployment, Security, and Folder Redirection. Userenv log files reveal what is occurring in the background as a user logs on   Userenv.log file located in the %SystemRoot%\Debug\UserMode folder Userenv log files contains information about the following: Group Policy settings that are not processed or not applied as expected Folder redirection that does not occur Profile or registry hive load, unload, or deletion failures Logon script, or script not applied as expected Default behaviors occurring because a slow link was detected Roaming profile issues Slow logon issues Whether a given GPO is accessible, and if not, why access was denied. The name of the domain controller that is accessing SYSVOL. The Userenv log has a maximum size of 1 megabyt
Read more