WinDbg User mode / application debugging Important commands


Example

Documenting your work

Remember what you've done and retain long outputs which can't be kept in WinDbg's buffer. It's always good to have a log available for reproducing debugging steps, e.g. to ask questions on Stack Overflow.

CommandPurpose
.logopencreate a log file
.logcloseclose the log file
.dumpsave crash dump file (snapshot of the current debugging session)

Working with symbols

Without or with incorrect symbols, you may receive wrong information and be misled. Make sure you're familiar with these commands before starting work in WinDbg. See also How to set up symbols in WinDbg.

CommandPurpose
.symfixset or add symbols to official Microsoft symbol path
.sympathset or add own or 3rd party symbols
.reloadreload symbols
.symoptdefine symbol handling options
!symcontrol symbol loading
xexamine symbols
lnlist nearest symbols

Crash analysis

Find out what has happened (in crash dumps) and how to handle events (in live debugging).

CommandPurpose
.exrdisplay exception record
.lasteventdisplay last event
sxdefine exception handling
!analyzeanalyze a crash or hang
!avrfapplication verifier

The environment

Check the process name and version information.

CommandPurpose
| (pipe)process information
lmmodule list

Threads, call stacks, registers and memory

Inspect the details.

CommandPurpose
~thread list
rregisters
kcall stack
d*display memory
e*edit memory
ssearch memory
.formatsconvert between number formats
?evaluate expression
u*disassemble
aassemble
!addressmemory info

Controlling the target

In live debugging, take control the execution.

CommandPurpose
ggo / continue
gugo up
psingle step
ttrace (single step and output registers)
bpset breakpoint
blbreakpoint list

Working with extensions

Extensions may provide significant advantages and enhancements.

CommandPurpose
.loadload extension (full path)
.loadbyload extension relative to module
.chaindisplay loaded extensions
.unloadunload extension

Stop debugging

CommandPurpose
qquit and terminate application
qddetach and quit

Attach and detach

CommandPurpose
.tlistprocess list
.attachattach to process
.createcreate a process and attach
.childdbgdefine child process debugging behavior
.detachdetach from a process
.killkill a process
.restartrestart the process

Behavior of WinDbg

CommandPurpose
.prefer_dmlset debugger markup language handling
.effmachswitch the bitness

Usability Commands

CommandPurpose
.cmdtreeLoads a text file with predefined commands in a separate window

Getting Helps

CommandPurpose
.hhDisplays the help manual for WinDbg commands