Thematically groupped WinDBG commands: Common WinDbg Commands (Thematically Grouped)

Command Meaning
!peb display formatted PEB
dt nt!_PEB Addr full PEB dump
lm list loaded and unloaded modules
lm vm kernel32 verbose output (incl image, syml information)
!dlls display loaded modules with loader info
!imgreloc display relocation info
!dh kernel32 display headers
!gle Get Last Error
!process 0 4 processname.exe print all threads of process
!teb display formatted teb
dt nt!_TEB Addr full TEB dump
k, kP, kf, kv, kb display call stack for current thread
P == full parameters for each function called
f == distance between adjacent frames to be displayed (useful to check stack consumption of each frame)
v == display FPO information + calling convention
b == display the first three parameters passed to each function
d, dd, da, du… Display memory
dd == double word values
da == display ASCII characters
du == display Unicode characters
f 0012ff40 L20 ‘A’ ‘B’ ‘C’ fill 20 elements with ABC starting at address
!vprot MyAddr Displays virtual memory protection information for MyAddr
!address MyAddr Display information (type, protection, usage, ..) about the memory specified by MyAddr
!heap print all heaps
!locks displays a list of locked critical sections for the process
!locks -v display all critical sections for the process
!cs -l [CsAddr] Displays one or more critical sections, or the entire critical section tree.
-l == display only locked sections
-s == causes each CS’s initialization stack to be displayed
-o == causes the owner’s stack to be displayed
-t == display critical section tree -> EnterCntr, WaitCnt, …
!avrf -cs Display a list of deleted critical sections (DeleteCriticalSection API)
!critsec [CsAddr] displays the same collection of information as !ntsdexts.locks
dt Display information about a local variable, function parameter, global variable or data type
dv Display local variables
dv /t /i /V Display local variables
/i == classify them into categories (parameters or locals)
/V == show addresses and offsets for the relevant base frame register (usually EBP)
/t == display type information
dd 0046c6b0 L1 display 1 dword at 0046c6b0
dd 0046c6b0 L3 display 3 dwords at 0046c6b0
du 0046c6b0 display Unicode chars at 0046c6b0
ad Name
ad *
Delete alias with Name
al List user-named aliases
${Alias} ${Alias} is replaced by the alias equivalent, even if it is touching other text. If the alias is not defined, the ${Alias} is not replaced
${/f:Alias} Same as above except that ${/f:Alias} is replaced with an empty string if the alias is not defined
${/n:Alias} Evaluates to the alias name
${/d:Alias} Evaluates: 1 = alias defined; 0 = alias not defined
be, bd
Set Breakpoint
Set Unresolved Breakpoint: defers the actual setting of the breakpoint until the module is loaded
Break on Access
Breakpoint Clear
Breakpoint Enable, Disable
ba r4 0012fe34
ba w2 0012fe38
break on access (read or write); monitor 4 bytes
break on access (write); monitor 2 bytes
bu kernel32!LoadLibraryExW 5 Breakpoint that will starts hitting after 5 passes
~1 bu kernel32!LoadLibraryExW Break only if called from thread ~1
bp mod!myFunc* Break at all symbols with pattern myFunc*
.lastevent first-change or second-chance?
!analyze -v Displays detailed information about the current exception
.exr -1 Display most recent exception
.exr Addr Display exception at Addr
!cppexr Addr Display c++ exception at address Addr
g, gH
Go with Exception Handled
Go with Exception Not Handled
.dump /ma D:\large.dmp all possible data: full memory, code sections, PEB and TEB’s, handle data, thread time information, unloaded module lists, and more
.dump /m d:\small.dmp only basic information: module information (signatures), thread and stack information
r print all registers
d * view memory
e * edit memory
~1 ~2 change context to processor 1/2
ed nt!Kd_Default_Mask 8 Включить DbgPrint прям в консоль windbg
__debugbreak(); Команда плюсов, замена int3
.reload /u Выгрузить модули (например при перекомпиле выгрузить pdb)
dds nt!KiServiceTable+syscall*4 Интерпретировать адреса как символы
dt _EPROCESS 81F24BD0 -r1 print recursively -rN - N - level of recurse
~0s / ~1s / ~2s switch processor
dt nt!_kprcb view Kernel Processor Control Block
!prcb address of KPRCB for current processor
!handle 0 3 EPROCESSADDRESS File show all handles of process of concrete type
dd /c1 ADDRESS L30 list in one column 30 values
.cmdtree call help
.thread ADDRESS switch to thread in kernel
!error @eax interpret NTSTATUS in eax
.chain extensions
.load C:\way\to\dll\Mex.dll load new extension
!reload -u unload all modules (for ex if you wannd recompile file, but you’ve loaded pdb into windbg, you need to unload it)
?? sizeof(nt!_IRP) get size of structure
!thread XXX
!irp addrX
gives IRP List addrX
gives holding IRP’s by thread
!dpcs list dpc queue for the current processor
bp sampleapp!file.cpp:6 “.if (dwo(VARIABLE)>0n100) {} .else { gc } run command at break with if (MASM syntax)
bp sampleapp!file.cpp:6 “.if (@@(VARIABLE)>0n100) {} .else { gc } same in C++ syntax
db poi(VAR) dereference
.childdbg [0/1] enable child debugging

Full windbg syntax commands, that I once used:

bp kernel32!CreateFileW “.echotime;.echo====================;dps rcx L2;g”
.for (r $t0 = 0; @$t0 < 0x4; r $t0 = @$t0 + 1) {.echotime;.echo====================;!irql;t;}