WinDbg

Great Reads

.natvis Files and Type Templates in WinDbg

by Sebastian Solnica

.natvis files and type templates in WinDbg

NetExt – SOS on Steroids

by Sebastian Solnica

NetExt – SOS on Steroids

Finalizer Case Explained

by LiYS

Finalizer case explained

Digging into .NET Object Allocation Fundamentals

by Ben M Watson

Understand exactly what happens during object allocation in .NET, why it's extremely efficient in the common case, and how to trigger slower code paths

Latest Articles

Hacking with Windbg - Part 2 (Minesweeper)

by Sarthak S

Assembly inspection and hacking with windbg

Hacking with Windbg - Part 1 (Notepad)

by Sarthak S

Assembly inspection and hacking with windbg

Load a x86 DLL into a x64 Executable... Mission Possible?

by Michael Chourdakis

Try deep CPU features

Finalizer Case Explained

by LiYS

Finalizer case explained

All Articles

top

WinDbg

.natvis Files and Type Templates in WinDbg

4 Jul 2016 by Sebastian Solnica

.natvis files and type templates in WinDbg

WinDbg

Debugging windows program without source code.

30 May 2014 by kaushik_code

A few days back I faced this problem at work and I was wondering is there a way to mint out more data from the scenario than to go to Microsoft. There has been many cases like this and I wanted to explore that as a windows developer what is the best /optimum way to fetch most of info is such...

Windows

WinDbg

debugging

Debugging windows program without source code.

30 May 2014 by Sergey Alexandrovich Kryukov

Such debugging is possible but not really productive, too much labor-taking. And having debugging without the ability to patch the PE (I used to work with the system providing patch facility, but that's far from Windows :-)) won't help you much.But you mentioned the "because it is locked by...

Windows

WinDbg

debugging

NetExt – SOS on Steroids

10 Jul 2015 by Sebastian Solnica

NetExt – SOS on Steroids

Blue screen again : usbhub! Usbhhubprocesschangeworker+ec

28 Apr 2018 by Jochen Arndt

Quote: Here it gives int ,why ? what does it mean ? INT (Interrupt) 3 is inserted by debuggers when setting a breakpoint. Once that is hit, the debugger takes control and removes the INT 3 instruction by replacing it with the original code to allow continuation of the debugged process. [EDIT]...

WinDbg

WinDbg Analysis Help Please.

3 Jul 2012 by SS-NBL

Hi There - Can anyone offer any suggestions on what the problem may be from this WinDbg analysis log :Microsoft (R) Windows Debugger Version 6.12.0002.633 X86Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File...

WinDbg

WinDBG tool not able to respond to my vc++ application crash

22 Aug 2012 by litu kumar

Hi,I have installed WinDBG tool (dbg_x86_6.9.3.113)in my windows XP .Then I register WinDBG by using command "Windbg -I"For generating a crash-dump ,I hv created a simple dialog based application whichcreating a crash(application-crash).I put the Symbol file(.PDB) of this...

C++

VC8.0

WinDbg

Find Process Memory Addresses WINDBG

21 Nov 2012 by Marshall Singh

Hey all, Does anyone know a method to read the memory addresses of an attached process in WINDBG. They can be accessed through the memory window but i intend to use them in my extension dll, so a programmatic approach would be more helpful.Thanks in advance.

Find Process Memory Addresses WINDBG

21 Nov 2012 by E.F. Nijboer

Have a look at psapi for that.http://msdn.microsoft.com/en-us/library/windows/desktop/ms684884%28v=vs.85%29.aspx[^]Good luck!

mapping Function names and Memory addresses

10 Dec 2012 by Marshall Singh

Hey all, I am working on a WinDBG extension that can alter data of a running application. At this point i am able to fetch the memory addresses of critical sections. But my requirement is to get the memory address of a given function name.Is there a way to do the same (a direct...

.NET

WinDbg

debugging

mapping Function names and Memory addresses

10 Dec 2012 by Mohd. Mukhtar

Hi,Refer the below link, This may help you.http://social.msdn.microsoft.com/Forums/en-US/netfxbcl/thread/e14aadd4-5711-42a4-b635-4044e219493e/[^]How to write a Memory Scanner using C#[^]

.NET

WinDbg

debugging

mapping Function names and Memory addresses

11 Dec 2012 by Marshall Singh

When you need to find the address at which a known function or a global variable resides, you canuse the x command of the windbg.exe debugger. This translation is often useful when trying to setcode or data breakpoints. For this to work, naturally, the module (DLL or main EXE) that contains...

.NET

WinDbg

debugging

Fn address not getting available

14 Dec 2012 by Marshall Singh

Hey all,I am new to windbg.my intention is to debug my demo application (windows forms) and try to corrupt a specific function in the memory.i am attaching my app to windbg;fetching the address of a function (some button click, through x command) and putting an unresolved breakpoint...

Fn address not getting available

19 Dec 2012 by Marshall Singh

i tried sosex dll. !mbm command worked for me. i was able to place an unresolved bp and hit it wen the module was loaded.

WinDBG tool not able to respond to my vc++ application crash

20 Dec 2012 by Blake Miller

And if you REALLY want to debug your application, insert a DebugBreak() function call into it somewhere convenient - based on a button, or user action, or even close to its startup.

C++

VC8.0

WinDbg

WinDBG tool not able to respond to my vc++ application crash

29 Dec 2012 by Mattias Högström

I dont use automatic saving of memory dumps myself.I always either store the memory dump manually or attach windbg while it is running.The TaskManager can store memory dumps.Right click on a process and select "Create Dump File".If you run under x64, you will need to use the 32 bit...

C++

VC8.0

WinDbg

Setting up a postmortem debugger for Windows services

15 Dec 2013 by Allgaeuer

Hello folks,Is it possible to create a full memory dump of a Windows service when it crashes? Obviously, there are the well known postmortem debuggers, which can collect a memory dump of a failing process. But the problem with Windows services is that they are running within the...

debugger

WinDbg

debugging

Facing an issue with Heap Corruption on a Specific Vmware Application

11 Aug 2014 by gaurav baghla

Facing an issue with Heap Corruption on a Specific Vmware Application

Windows

WinDbg

VMware

How Can I Find The Root Cause Running Out Of Freesysptes

27 Oct 2014 by Member 11184348

Need some debug helpI manage to get the !sysptes 4 working on the affected machines.It shows hunderds of the following items, guess it is eating the syspte'skd> !sysptes 40x722 System PTEs allocated to mapping locked pagesVA MDL PageCount Caller/CallersCallerf7857000...

WinDbg

How Can I Find The Root Cause Running Out Of Freesysptes

7 Nov 2014 by Member 11184348

Guess this is the wrong forum to ask it.Thx anyway.

WinDbg

Vmmap managed heap (private working set) is 10 times total GC heap

16 Aug 2016 by Member 11316006

I am trying to understand the RAM utilization of my application and confused because with below observations. - VMMap shows that managed heap size of my application is around 110 MB and almost all of it is in Private Working Set (Private WS) [Screenshot of VMMap]If I write a full...

Blue screen again : usbhub! Usbhhubprocesschangeworker+ec

27 Apr 2018 by codeprojectddx

I have debugged the minidump file . I have some problems . Windbg provides me infomation below: CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xFE PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff88005a12a60 to fffff80004293bc0 ...

WinDbg

In windbg, is there any way to sort the threads based on the last activity?

1 Aug 2020 by Coder969

Our application is getting hung intermittently. We got the memory dump and I loaded it to windbg. There are more than 100 threads it shown in the windbg. I want to know what is the recent thread got executed before the hang occured. So I want to...

WinDbg

In windbg, is there any way to sort the threads based on the last activity?

1 Aug 2020 by Richard MacCutchan

See Controlling Processes and Threads - Windows drivers | Microsoft Docs[^]

WinDbg

GC hang - how to investigate thread that is blocking itself according to debugdiag?

9 Dec 2021 by codefast1993

I have a mixed mode dll (C++/Cli) that is referenced in a C# application. It crashes with the error: name_here.dll has caused an access violation exception(0xC0000005) when trying to read from memory location 0x00000000 on thread 243. What I...

Finalizer Case Explained

28 Apr 2018 by LiYS

Finalizer case explained

Digging into .NET Object Allocation Fundamentals

29 Sep 2014 by Ben M Watson

Understand exactly what happens during object allocation in .NET, why it's extremely efficient in the common case, and how to trigger slower code paths

Optimizing Memory Allocations in .NET Applications

28 Dec 2015 by Dmitry Orzhevsky

This article describes a set of tools and techniques which can be used to find memory allocation problems in .NET code and help significantly boost your app performance.

A Mixed-Mode Stackwalk with the IDebugClient Interface

22 Apr 2012 by Mattias Högström

A native stackwalk funtion like Stackwalk64 cannot handle mixed-mode stacks, since managed code does not use the stack in the same way as native code does. There is an API called IDebugClient, that does walk a mixed-mode stack correctly, which we will explore.

Get method name from an eventhandler with WinDbg

27 Sep 2012 by Charles Ju

This article describes how to get the method name from an EventHandler with WinDbg.