WinDbg provides a set of debugging extensions for kernel-mode driver debugging. These extensions allow the user to obtain additional extended information specific to kernel-mode debugging not available through the standard WinDbg commands.
The command-line syntax for a built-in extension is:
!extension_name [arguments]
!cxr address
!cxr displays the context record at the specified address.
Power PC, Alpha, MIPS, x86
The information from a context record can be used to assist in debugging a system halt where an unhandled exception has occurred and an exact stack trace is not available.
!db [PhysicalAddress]
!db displays a hexadecimal and ASCII dump of 128 bytes from the specified address on the target machine.
Power PC, Alpha, MIPS, x86
!dd [PhysicalAddress]
!dd displays a hexadecimal dump of 32 ULONG values from the specified address on the target machine.
Power PC, Alpha, MIPS, x86
!default DLLName
!default changes the default extension DLL for WinDbg.
Power PC, Alpha, MIPS, x86
WinDbg maintains a default extension DLL which is implicity loaded when WinDbg loads. This allows the user to specify an extension command without first having to load a extension DLL. This command allows modification of which DLL is loaded as the default DLL.
!devobj address
!devobj displays detailed information about a DEVICE_OBJECT.
Power PC, Alpha, MIPS, x86
!drvobj address
!drvobj displays detailed information about a DRIVER_OBJECT.
Power PC, Alpha, MIPS, x86
!drivers
!drivers displays memory usage information and a list of each driver loaded on the target machine.
Power PC, Alpha, MIPS, x86
!ed PhysicalAddress Data0 [Data1 ... DataN]
!ed writes a sequence of ULONG values into a specified physical address.
Power PC, Alpha, MIPS, x86
!errlog
!errlog displays the contents of any pending error log entries.
Power PC, Alpha, MIPS, x86
This command will only display entries that were queued by IoWriteErrorLogEntry but have not been committed to the error log. This command can be used as a diagnostic aid to see pending error information which was unable to be committed to the error log before the system halted.
!exr Address
!exr displays the contents of an exception record.
Power PC, Alpha, MIPS, x86
This command will display information related to an exception encountered on the target machine. The information displayed will include the exception address, exception code, exception flags, and a variable list of parameters to the exception.
!frag Flags
!frag displays fragmentation information about pool memory on the target system.
0 Minimum detail. 1 Moderate detail 2 Maximum detail.
Power PC, Alpha, MIPS, x86
!filecache
!filecache displays information regarding the system file cache memory and PTE usage.
Power PC, Alpha, MIPS, x86
!handle [Handle] [Flags] [Process] [TypeName]
!handle displays information about a handle or handles owned by one or all processes in the target system.
Flags
TypeName
Power PC, Alpha, MIPS, x86
This command can be used to display all handles for a specified process. In order to do this, a value of 0xFFFFFFFF is required for Handle with a valid process ID specified for Process.
!heap [Address] [Detail]
!heap displays heap usage information in varying levels of detail for the current process.
Address
0 (default) Summary information about the heap 1 Level 0 information with the size and location
all the committed and uncommitted regions. 3 Level 1 information with the allocated and free
blocks contained in each committed region 4 Level 3 information with a dump of the free lists
in the heap.
!irp Address [Verbose]
!irp displays information about an IRP.
Power PC, Alpha, MIPS, x86
!irpfind [Options]
!irpfind displays information about all IRPs currently allocated in the target system.
Power PC, Alpha, MIPS, x86
!irpzone is an obsolete debugger extension command and debugger users should instead see !irpfind.
!kb
!kb displays a stack trace which is obtained from a trap frame. This command must be used after a !trap so that !kb can use the loaded trap frame information to find the call stack.
Power PC, Alpha, MIPS, x86
!load [DllName]
!load is used to load a new extension DLL into the debugger. Once this command has been completed, it allows the user to access the commands stored in the loaded extension.
Power PC, Alpha,. MIPS, x86
!locks [Options] [Address]
!locks displays information about kernel ERESOURCE locks.
Power PC, Alpha, MIPS, x86
!lookaside [Address] [Options] [Depth]
!lookaside displays information or modifies information of a lookaside list on the target system.
0 (default) Displays information about the lookaside list 1 Resets the counters of the lookaside list 2 Modifies the depth of the lookaside list
Power PC, Alpha, MIPS, x86
Options must be 0 or 1 if this command is being used to look or modify the system lookaside lists. If a 1 is specified, then it will reset the counters for all of the system lookaside lists which are displayed as part of this command.
!lpc
!lpc displays information about all LPC ports and messages in the target system.
Power PC, Alpha, MIPS, x86
!memusage
!memusage displays a dump of the page frame database table from the Memory Manager.
Power PC, Alpha, MIPS, x86
!noversion
!noversion causes WinDbg to disable all version checking for extension DLLs.
Power PC, Alpha, MIPS, x86
!object [Address] [Name]
!object displays information about a system object.
!object can also be used with to display information about the root directory holding all objects. If Address is specified to be the character ‘\’, then information about the root directory object will be displayed.
Power PC, Alpha, MIPS, x86
!pcr [Processor]
!pcr displays the current status of the PCR register on a specific processor.
Power PC, Alpha, MIPS, x86
!pfn [Number] [Flags]
!pfn displays information about a specific page frame or the whole page frame database.
Power PC, Alpha, MIPS, x86
!pool [Address] [Flags]
!pool displays information about a specific pool allocation or can display information about the system wide pool.
Power PC, Alpha, MIPS, x86
!poolfind [Tag] [PoolType]
!poolfind is used to find all instances of a specific pool tag in either nonpaged or paged memory pools.
This command can take a significant amount of time to execute depending on the size of pool memory which must be searched.
Power PC, Alpha, MIPS, x86
!poolused [Flags]
!poolused displays memory usage summaries based on the tag used for each pool allocation.
Power PC, Alpha, MIPS, x86
!process [Address]
!process displays summary information about a process.
Power PC, Alpha, MIPS, x86
!ready
!ready displays summary information about each thread in the system in a READY state.
Power PC, Alpha, MIPS, x86
!reload [Module]
!reload reloads the symbols for a specified module.
Power PC, Alpha, MIPS, x86
!srb [Address]
!srb displays information about an SRB request.
Power PC, Alpha, MIPS, x86
!sympath [NewPath]
!sympath changes the default path of the host debugger for symbol search.
Power PC, Alpha, MIPS, x86
!thread [Address]
!thread displays summary information about a thread on the target system.
Power PC, Alpha, MIPS, x86
!trap [Address]
!trap displays summary information about a trap frame.
Power PC, Alpha, MIPS, x86
!unload
!unload unloads the current extension DLL from the debugger on the host system.
Power PC, Alpha, MIPS, x86
!vad [Address] [Flags]
!vad displays information about virtual address(s) on the target machine.
Power PC, Alpha, MIPS, x86
!vm
!vm displays summary information about memory usage statistics on the target system.
Power PC, Alpha, MIPS, x86