:WinDbg

Like the Visual Studio Debugger, WinDbg has a graphical user interface (GUI), but is more powerful and has little else in common. WinDbg can automatically load debugging symbol files (e.g., PDB files) from a server by using a unique ID embedded in the executable (using the "RSDS Guid"{{cite web|url=https://github.com/dotnet/runtime/blob/main/docs/design/specs/PE-COFF.md#debug-directory|title=PE/COFF Specification Addendum|accessdate=11 March 2024}}) via SymSrv (SymSrv.dll),{{cite web|url=https://support.microsoft.com/en-us/kb/311503/|title=Debugging with Symbols (Windows)|website=Support.microsoft.com|accessdate=23 April 2018}} instead of requiring users to manually find the files. If a private symbol server is configured, the symbols can be correlated with the source code for the binary. This eases the burden of debugging problems that have various versions of binaries installed on the debugging target by eliminating the need for finding and installing specific symbols version on the debug host. Microsoft has a public symbol server that has most of the public symbols for Windows 2000 and later versions of Windows (including service packs).{{cite web|url=https://msdn.microsoft.com/en-us/library/windows/hardware/ff552208(v=vs.85).aspx|title=Microsoft public symbol server|last=DOMARS|website=Msdn.microsoft.com|accessdate=23 April 2018}}

WinDbg can also be used for debugging kernel-mode memory dumps, created after what is commonly called the Blue Screen of Death which occurs when a bug check is issued.{{cite web|url=http://www.techrepublic.com/blog/windows-and-office/how-do-i-use-windbg-debugger-to-troubleshoot-a-blue-screen-of-death/|title=How do I use WinDBG Debugger to troubleshoot a Blue Screen of Death?|website=TechRepublic|date=18 December 2009 |accessdate=23 April 2018}} It can also be used to debug user-mode crash dumps. This is known as post-mortem debugging.{{cite web|url=https://tewarid.github.io/2010/09/10/post-mortem-debugging-of-.net-applications-using-windbg.html|title=Post-mortem debugging of .NET applications using WinDbg|date=10 September 2010|website=Tewarid.github.io|accessdate=23 April 2018}}

WinDbg is distributed as a standalone package from the [https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/#install-windbg-directly Windows Debugger Portal] and via the [https://www.microsoft.com/store/productId/9PGJGD53TN86?ocid=pdpshare Microsoft Store]. The WinDBG Debugger Engine is the common debugging back-end between WinDbg and command line debugger front-ends like [https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-using-kd-and-ntkd KD], [https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-using-cdb-and-ntsd CDB], and [https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-using-cdb-and-ntsd NTSD]. Most commands can be used as is with all the included debugger front-ends.

In 2023 Microsoft released a new version of WinDbg which was announced in 2017 as WinDbg Preview (WinDbgX).{{Cite web|url=https://blogs.msdn.microsoft.com/windbg/2017/08/28/new-windbg-available-in-preview/|title=New WinDbg available in preview! – Debugging Tools for Windows|website=blogs.msdn.microsoft.com|access-date=2019-08-13}} One of the most notable features is so called Time-Travel-Debugging (TTD).{{Cite web|url=https://blogs.msdn.microsoft.com/rodneyviana/2018/03/08/leveraging-the-new-windbgx-and-time-travel-trace-script-to-list-all-access-to-files/|title=Leveraging the new WinDbgX and Time-Travel-Trace –Script to list all access to files – Rodney Viana's (MSFT) Blog|website=blogs.msdn.microsoft.com|access-date=2019-08-13}} TTD allows a user to record an actual live process (at a performance penalty) to later debug going back and forth in time. In addition, WinDbg has updated user interface, support for dark mode and keyboard navigation. It also allows writing scripts in the JavaScript language.{{Cite web|url=https://aavar.org/avar2018/index.php/easier-windbg-scripting-with-javascript-for-malware-research/|title=Easier WinDbg scripting with Javascript for malware research – Avar 2018|language=en-US|access-date=2019-08-13}}{{Cite web|url=https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/windbg-overview|title=What is WinDbg|language=en-US|access-date=2024-07-27}}

WinDbg allows the loading of extension DLLs{{cite web|url=https://msdn.microsoft.com/en-us/library/windows/hardware/ff563964(v=vs.85).aspx|title=.load, .loadby (Load Extension DLL)|last=DOMARS|website=Msdn.microsoft.com|accessdate=23 April 2018}} that can augment the debugger's supported commands and allow for help in debugging specific scenarios: for example, displaying an MSXML document given an IXMLDOMDocument, or debugging the Common Language Runtime (CLR).{{cite web|url=https://msdn.microsoft.com/en-us/magazine/cc163791.aspx|title=MSDN Magazine Issues|website=Msdn.microsoft.com|accessdate=23 April 2018}} These extensions are a large part of what makes WinDbg such a powerful debugger. WinDbg is used by the Microsoft Windows product team to build Windows, and everything needed to debug Windows is included in these extension DLLs.

Extension commands are always prefixed with !.

While some extensions are used only inside Microsoft, most of them are part of the public Debugging Tools for Windows package.

The extension model is documented in the help file included with the Debugging Tools for Windows.

Ext is a standard Windows Debugger extension that ships with WinDBG and is loaded by default.

The most commonly used command is !analyze -v,{{cite web|url=https://msdn.microsoft.com/en-us/library/windows/hardware/ff562112(v=vs.85).aspx|title=analyze|last=DOMARS|website=Msdn.microsoft.com|accessdate=23 April 2018}} which analyzes the current state of the program being debugged and the machine/process state at the moment of crash or hang. This command is often able to debug the current problem in a completely automated fashion.

When used without any switches, !analyze simply returns the results of its analysis. The -v and -vv give further details about that analysis.

Wow6432exts is a standard Windows Debugger extension that ships with WinDBG.

It is used to debug processes running inside WoW64 (32-bit processes running in 64-bit Windows).{{cite web|url=https://msdn.microsoft.com/en-us/library/windows/desktop/aa384163(v=vs.85).aspx|title=Debugging WOW64 (Windows)|website=Msdn.microsoft.com|accessdate=23 April 2018}}

The SOS (Son of Strike){{cite web|url=http://blogs.msdn.com/b/jasonz/archive/2003/10/21/53581.aspx|title=SOS Debugging of the CLR, Part 1|website=Blogs.msdn.com|accessdate=23 April 2018|url-status=dead|archive-url=https://web.archive.org/web/20100628154809/http://blogs.msdn.com/b/jasonz/archive/2003/10/21/53581.aspx|archive-date=28 June 2010}} Debugging Extension (SOS.dll) assists in debugging managed programs in Visual Studio and WinDbg by providing information about the internal common language runtime (CLR) environment. This tool requires a project to have unmanaged debugging enabled. SOS.dll is automatically installed with the .NET Framework. To use SOS.dll in Visual Studio, install the [https://learn.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk Windows Driver Kit (WDK)].{{cite web|url=https://msdn.microsoft.com/en-us/library/bb190764.aspx|title=SOS.dll (SOS Debugging Extension)|last=mairaw|website=Msdn.microsoft.com|accessdate=23 April 2018}} To debug a process or memory dump, the sos.dll version must match the .NET Framework version. Psscor2 and Psscor4 are a superset of SOS.

Psscor2 is the Windows Debugger Extension used to debug .NET Framework applications that use the .NET CLR version 2.0 (.NET Framework versions 2 through 3.5). Psscor2 was developed for internal use at Microsoft as part of their Product Support Services tools.{{cite web|url=http://blogs.msdn.com/b/tess/archive/2010/03/30/new-debugger-extension-for-net-psscor2.aspx|title=New debugger extension for .NET (PSSCOR2)|website=Blogs.msdn.com|accessdate=23 April 2018}} While Microsoft only released Psscor2 in 2010 {{cite web|url=http://blogs.msdn.com/b/tom/archive/2010/03/29/new-debugger-extension-for-net-psscor2-released.aspx|title=New debugger extension for .NET, Psscor2, released|website=Blogs.msdn.com|accessdate=23 April 2018}} Microsoft had been publishing commands from the extension several years before,{{cite web|url=http://msdn.microsoft.com/en-us/magazine/cc163833.aspx|title=MSDN Magazine Issues|website=Msdn.microsoft.com|accessdate=23 April 2018}} causing difficulty for those who were trying to follow their processes.

Psscor4 is a Windows Debugger extension used to debug .NET Framework 4 applications.

WinDbg allows debugging a Microsoft Windows kernel running on a virtual machine by VMware, VPC or Parallels using a named pipe. This can be achieved by using a virtual COM port. In the case of VMware and VirtualBox, the VirtualKD extension adds native support for VM debugging to the Windows kernel, claiming to speed debugging by a factor of up to 45.{{cite web|url=http://virtualkd.sysprogs.org/|title=VirtualKD - Windows Kernel Debugger Booster for Virtual Machines|website=Virtualkd.sysprogs.org|accessdate=23 April 2018}} For Windows 8 and later, kernel debugging over network is allowed,{{cite web|url=https://msdn.microsoft.com/en-us/library/windows/hardware/hh439346(v=vs.85).aspx|title=Setting Up Kernel-Mode Debugging over a Network Cable Manually|last=DOMARS|website=Msdn.microsoft.com|accessdate=23 April 2018}} allowing fast kernel debugging without special configuration.

The WinDbg protocol is not documented, but is supported by the IDA Pro and radare2 disassemblers.

• ProcDump
• Microsoft Detours

{{Reflist}}

• Getting Started: [http://blogs.msdn.com/johan/archive/2007/01/11/how-to-install-windbg-and-get-your-first-memory-dump.aspx Install Instructions], [http://blogs.msdn.com/johan/archive/2007/11/13/getting-started-with-windbg-part-i.aspx Part 1], [http://blogs.msdn.com/johan/archive/2007/11/26/getting-started-with-windbg-part-ii.aspx Part 2]
• [http://www.microsoft.com/whdc/devtools/debugging/default.mspx Debugging Tools for Windows] - information and free downloads
• [http://windbg.info/doc/2-windbg-a-z.html WinDbg. From A to Z! ] - Theory and examples, 111 slides
• [http://windbg.info/doc/1-common-cmds.html Common WinDbg Commands (Thematically Grouped)]
• [http://www.networkworld.com/news/2005/041105-windows-crash.html Tutorial on solving system crashes using WinDbg] {{Webarchive|url=https://web.archive.org/web/20071012015505/http://www.networkworld.com/news/2005/041105-windows-crash.html |date=2007-10-12 }}
• [http://www.windowstipspage.com/2011/02/symbol-server-path-windbg-debugging.html Symbols loading in WinDbg]
• [http://www.codeproject.com/KB/debug/windbg_part1.aspx Windows Debuggers: Part 1: A WinDbg Tutorial]
• [http://virtualkd.sysprogs.org/ KD extension for fast VMware and VirtualBox debugging]
• [https://msdn.microsoft.com/en-us/library/bb190764.aspx SOS Debugging Extension (SOS.dll)]
• [http://www.microsoft.com/en-us/download/details.aspx?id=21255 psscor4 (.NET 4.0)] or [http://www.microsoft.com/en-us/download/details.aspx?id=1073 psscor2 (.NET 2.0-3.5)] Replacement for SOS with a superset of commands
• [http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=36a2630f-5d56-43b5-b996-7633f2ec14ff] WinDBG v6.12.2.633 available via Windows Driver Kit Version 7.1.0
• [http://pykd.codeplex.com Extension for python scripting (pykd)]
• [http://www.andreybazhan.com/dbgkit DbgKit: the first GUI extension for Debugging Tools for Windows]

{{Microsoft development tools}}

Category:Debuggers

Category:Microsoft software