The command .WRITEMEM allows us to save memory into a disk file. The cool thing about it is that we can save modules too, because they are just raw memory.…
-
-
!wow64exts.sw Switches between x86 and native mode. I’d like to introduce you to how to switch to a kernal mode from a apps mode. This is how a apps…
-
We can create a dump file from a running application or active driver crash using WinDbg. After the dump file is collected, it can be copied to another machine to…
-
This post is for driver or kernel developers/enthusiasts who have encountered a Blue Screen of Death on Windows where the bugcheck code is 0x9F, DRIVER_POWER_STATE_FAILURE, and parameter 1 is 0x3. There…
-
The !devstack extension displays a formatted view of the device stack associated with a device object. The !devnode extension displays information about a node in the device tree. 1. WDM…
-
The symbol path specifies locations where the Windows debuggers (WinDbg, KD, CDB, NTST) look for symbol files. Microsoft OS symbols are located at: https://msdl.microsoft.com/download/symbols You can set the symbols in multiple ways:…
-
Use the Microsoft Symbol Server to obtain debug symbol files http://support.microsoft.com/kb/311503 other useful commands: !symfix .reload !analyze -v !sym noisy .symopt+ 0×40 .sympath SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols Sometimes we could have a dump…
-
-
-
- 1
- 2