WinDbg

WinDbg
Developer(s) Microsoft
Stable release 6.3.9600.16384 / August 22, 2013
Operating system Microsoft Windows
Type Debugger
License Commercial
Website WinDbg at microsoft.com

WinDbg is a multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.[1] It can be used to debug user mode applications, device driver, and the operating system itself in kernel mode. It is a GUI application, but it has little in common with the better known, but less powerful, Visual Studio Debugger.

WinDbg can be used for debugging kernel-mode memory dumps, created after what is commonly called the Blue Screen of Death which occurs when a bug check is issued.[2] It can also be used to debug user-mode crash dumps. This is known as post-mortem debugging.[3]

WinDbg also has the ability to automatically load debugging symbol files (e.g., PDB files) from a server by matching various criteria (e.g., timestamp, CRC, single or multiprocessor version) via SymSrv (SymSrv.dll).[4] This is a very helpful and time saving alternative to creating a symbol tree for a debugging target environment. If a private symbol server is configured, the symbols can be correlated with the source code for the binary. This eases the burden of debugging problems that have various versions of binaries installed on the debugging target by eliminating the need for finding and installing specific symbols version on the debug host. Microsoft has a public symbol server that has most of the public symbols for Windows 2000 and later versions of Windows (including service packs).[5]

Recent versions of WinDbg have been and are being distributed as part of the free Debugging Tools for Windows suite, which shares a common debugging back-end between WinDbg and command line debugger front-ends like KD, CDB, and NTSD. Most commands can be used as is with all the included debugger front-ends.

Extensions

WinDbg allows the loading of extension DLLs[6] that can augment the debugger's supported commands and allow for help in debugging specific scenarios: for example, displaying an MSXML document given an IXMLDOMDocument, or debugging the Common Language Runtime (CLR).[7] These extensions are a large part of what makes WinDbg such a powerful debugger. WinDbg is used by the Microsoft Windows product team to build Windows, and everything needed to debug Windows is included in these extension DLLs.

Extension commands are always prefixed with !.

While some extensions are used only inside Microsoft, most of them are part of the public Debugging Tools for Windows package.

The extension model is documented in the help file included with the Debugging Tools for Windows.

Ext.dll

Ext is the Windows Debugger standard extension that ships with WinDBG and loaded by default.

!analyze command

The most commonly used command is !analyze -v,[8] which analyzes the current state of the program being debugged and the machine/process state at the moment of crash or hang. This command is often able to debug the current problem in a completely automated fashion.

When used without any switches, !analyze simply returns the results of its analysis. The -v and -vv give further details about that analysis.

Wow6432exts.dll

Wow6432exts is the Windows Debugger standard extension that ships with WinDBG. It is used to debug processes running inside WoW64 (32-bit processes running in 64-bit Windows).[9]

SOS.dll

The SOS (Son of Strike)[10] Debugging Extension (SOS.dll) helps you debug managed programs in Visual Studio and in the Windows debugger (WinDbg.exe) by providing information about the internal common language runtime (CLR) environment. This tool requires your project to have unmanaged debugging enabled. SOS.dll is automatically installed with the .NET Framework. To use SOS.dll in Visual Studio, install the Windows Driver Kit (WDK).[11] To debug a process or memory dump you need sos.dll of exact same version of .NET Framework used in the process. Psscor2 and Psscor4 are a superset of SOS.

Psscor2.dll

Psscor2 is the Windows Debugger Extension used to debug .NET Framework applications that use the .NET CLR version 2.0 (.NET Framework versions 2 through 3.5). Psscor2 was developed for internal use at Microsoft as part of their Product Support Services tools.[12] While Microsoft only released Psscor2 in 2010 [13] Microsoft had been publishing commands from the extension several years before [14] causing difficulty for those who where trying to follow their processes.

Psscor4.dll

Psscor4 is a Windows Debugger extension used to debug .NET Framework 4 applications.

Coupling with virtual machines

WinDbg allows debugging Microsoft Windows kernel running on a VMware or VPC or Parallels virtual machine using a named pipe. This can be achieved by using a virtual COM port. Disadvantage of using COM port for kernel debugging is very low speed of data exchange because maximum baud rate of COM is 115200 bauds that is about 0,11 MB/s. Saving full memory dump of machine with 4Gb RAM goes about 10 hours. In the case of VMware or VirtualBox, the VirtualKD extension adds native support for VM debugging to Windows kernel that speeds up debugging up to 45 times.[15] Beginning from Windows 8 kernel debugging over network is allowed[16] that makes fast kernel debugging allowed from the box.

References

  1. ↑ https://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx
  2. ↑ http://www.techrepublic.com/blog/windows-and-office/how-do-i-use-windbg-debugger-to-troubleshoot-a-blue-screen-of-death/
  3. ↑ https://delog.wordpress.com/2010/09/10/post-mortem-debugging-of-net-applications-using-windbg/
  4. ↑ https://support.microsoft.com/en-us/kb/311503/
  5. ↑ https://msdn.microsoft.com/en-us/library/windows/hardware/ff552208(v=vs.85).aspx
  6. ↑ https://msdn.microsoft.com/en-us/library/windows/hardware/ff563964(v=vs.85).aspx
  7. ↑ https://msdn.microsoft.com/en-us/magazine/cc163791.aspx
  8. ↑ https://msdn.microsoft.com/en-us/library/windows/hardware/ff562112(v=vs.85).aspx
  9. ↑ https://msdn.microsoft.com/en-us/library/windows/desktop/aa384163(v=vs.85).aspx
  10. ↑ http://blogs.msdn.com/b/jasonz/archive/2003/10/21/53581.aspx
  11. ↑ https://msdn.microsoft.com/en-us/library/bb190764.aspx
  12. ↑ http://blogs.msdn.com/b/tess/archive/2010/03/30/new-debugger-extension-for-net-psscor2.aspx
  13. ↑ http://blogs.msdn.com/b/tom/archive/2010/03/29/new-debugger-extension-for-net-psscor2-released.aspx
  14. ↑ http://msdn.microsoft.com/en-us/magazine/cc163833.aspx
  15. ↑ http://virtualkd.sysprogs.org/
  16. ↑ https://msdn.microsoft.com/en-us/library/windows/hardware/hh439346(v=vs.85).aspx

External links