-
-
Dumping a module’s memory space (via WinDbg)
The command .WRITEMEM allows us to save memory into a disk file. The cool thing about it is that...
-
Creating a memory dump along with symbols using WinDbg
We can create a dump file from a running application or active driver crash using WinDbg. After the dump...
-
-
Forcing Symbols to match in WinDbg
Use the Microsoft Symbol Server to obtain debug symbol files http://support.microsoft.com/kb/311503 other useful commands: !symfix .reload !analyze -v !sym...
-
Stuck in the Apps Debug mode for a Kernal Crash dump?
!wow64exts.sw Switches between x86 and native mode. I’d like to introduce you to how to switch to a kernal...
-
0x9F BugCheck with Param 3? Here is how you go about it
Original Author: Michelle Bergeron Original Link: http://mrbit.me/How-To-Solve-Bugcheck-9F-3/ This post is for driver or kernel developers/enthusiasts who have encountered a Blue...
-
Making sense of Device objects & Driver Objects from a dump
The !devstack extension displays a formatted view of the device stack associated with a device object. The !devnode extension displays information about a...
-
Setting Symbols in WinDbg
The symbol path specifies locations where the Windows debuggers (WinDbg, KD, CDB, NTST) look for symbol files. Microsoft OS symbols...
Old is gold! Some windows debugging tutorials by Dmitry Vostokov
Dumping a module’s memory space (via WinDbg)
The command .WRITEMEM allows us to save memory into a disk file. The cool thing about it is that we can save modules too, because they are just raw memory.
Creating a memory dump along with symbols using WinDbg
We can create a dump file from a running application or active driver crash using WinDbg. After the dump file is collected, it can be copied to another machine to analyze and debug the problem (with symbols ofcourse). Here is a quick trick to get both, the dump and...