I won't cover the basic commands (lm
/dt
and more), but try to focus other unique but useful WinDBG utilities.
kd> ln fffff8014b60e180
- Shows the symbol for given address
kd> .writemem <dump_path> 0x80f5e000 L 0xA000
- Dumps a PE file to disk
kd> uf /c 0x833cfb43
- Unassemble Function - show only function calls.
kd> !dh 0x80f5e000
- Tries to parse a PE image header
kd> !dh -e ndis
- List export functions for loaded module
kd> lm m ndis
- Show specific module
kd> !process 0 0
- List all processes
kd> !process 0 0 cmd.exe
- Find process
kd> !process -1 0
- Current process context
kd> .process /i ffffd302f03020c0
- Switch to usermode process VAS
kd> .reload -user
- Reload user-mode symbols
kd> bp /p ffffd302f03020c0 ntdll!NtCreateFile
- Breakpoint in context of usermode process
kd> !token 0xffffaa08ba807635
- Info about a process token
kd> !pte fffff8016037a9f8
- Convert VA to PA
kd> !drvobj \Driver\kbdclass 2
- Extensive info about driver object
kd> !devobj 0x83272ca0
- Device object info
kd> !devstack 0x83272ca0
- Device stack for a device object
kd> !vpb 0x8325c298
- Volume Parameter Block: map between dev objects and physical devices
kd> !object \Device\Ide\IdeDeviceP0T0L0-0
- Query driver object
kd> !object \global??\c:
- Query symbolic link object
kd> .trap ffffa482a55cd990
- Set to trap frame context (to observe kernel registers). trap frame could be observed using kv
command
kd> !pool 0x833cfb43
- Info about pool page region
kd> !poolfind Driv
- Scans pools for specific tag
kd> !address 0x833cfb43
- Info about address region
kd> s-b 833cb000 833cb000+0x57000 4d 5a 90 00
- Searching for MZ in a region
kd> !fltkd.help
- Various commands for dealing with filter drivers
kd> !fltkd.filters
- Show filter list
kd> !ndiskd.help
- Various commands for dealing with NDIS drivers
kd> !ndiskd.miniports
- List of miniport NDIS drivers
kd> !ndiskd.minidriver ffffd7050de514f0 -handler
- Lists all handlers for specific driver
kd> !ndiskd.filters
- Query NDIS filters for each adapter
kd> !wdfkd.help
- Various commands for dealing with WDF drivers
kd> dp nt!PsInitialSystemProcess L1
- SYSTEM EPROCESS pointer
kd> dp nt!MmPteBase L1
- Page table base address. The value is being randomized in boot process
kd> dp nt!MmHighestUserAddress L1
- Highest address for userspace VA
kd> dp nt!MmSystemRangeStart L1
- Lowest address for kernel VA
kd> x nt!PsLoadedModuleList
- Loaded modules in kernel (_LIST_ENTRY)
kd> dt <list_base> nt!_KLDR_DATA_TABLE_ENTRY -l InLoadOrderLinks.Flink FullDllName
- Traversing loaded modules in kernel
kd> dq nt!SeLoadDriverPrivilege L1
- Privilege for loading a driver
kd> dps nt!HalDispatchTable
- HAL dispatch table
kd> dp nt!PsJobType L1
- Job creation configuration (_OBJECT_TYPE)
kd> dp nt!PsProcessType L1
- Process creation configuration (_OBJECT_TYPE)
kd> dp nt!PsThreadType L1
- Thread creation configuration (_OBJECT_TYPE)
kd> db nt!PspNotifyEnableMask L1
- Flag which can disable kernel notify routines
kd> rdmsr 0xc0000082
- System call handler (KiSystemCall64Shadow
)