### Get Command Request Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/programming-custom-credential-providers

An example of the request format sent to the credential provider for the 'Get' command, including protocol, host, path, and other relevant parameters. The request is terminated by an empty line.

```console
protocol=https
host=contoso.symbols.com
path=apis/symbol/symsrv
resourceKind=symbols
isretry=false 
issilent=false
parenthwnd=593598
<Followed by an empty line to indicate the end of the input data.>


```

--------------------------------

### Starting KD or CDB with Remote.exe Server (Method 1)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/starting-a-remote-exe-session

Examples of starting the Remote.exe server to launch KD or CDB on a remote computer. This method does not support NTSD.

```console
remote /s "KD [options]" MyBrokenBox 
```

```console
remote /s "CDB [options]" MyBrokenApp 
```

--------------------------------

### Start Debugging Servers

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-endsrv--end-debugging-server-

This example demonstrates starting two debugging servers using different protocols (npipe and tcp). These servers can be later canceled using the .endsrv command.

```dbgcmd
0:000> .server npipe:pipe=rabbit
Server started with 'npipe:pipe=rabbit'
0:000> .server tcp:port=7
Server started with 'tcp:port=7'
```

--------------------------------

### Start Remote Server with Command, Session Name, Colors, and User Permissions

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-server-syntax

This example demonstrates starting a remote server session with custom text and background colors, and specifying permitted users. The '/u' parameter restricts access to the specified users or groups.

```console
remote /s "cmd" "My Remote Session" /f white /b black /u Server01\Administrators
```

--------------------------------

### !wdfkd.wdffindobjects Example Output (No Flags)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wdfkd-wdffindobjects

This example demonstrates the output of the !wdfkd.wdffindobjects extension when called with a start address but no flags. It lists memory addresses, values, and associated WDF objects.

```dbgcmd
1: kd> !wdffindobjects 0xfffffa600211b668 
  Address             Value               Object
  ------------------  ------------------  ------------------
  0xfffffa600211b668  0x0000000000000008  
  0xfffffa600211b670  0xfffffa8002e7b1f0  !WDFREQUEST 0x0000057ffd184e08
  0xfffffa600211b678  0x0000000000000004  
  0xfffffa600211b680  0x0000000000000001  
  0xfffffa600211b688  0xfffffa8006aa3640  !WDFUSBPIPE 0x0000057ff955c9b8
  0xfffffa600211b690  0x0000000000000000  
  0xfffffa600211b698  0xfffff80001e61f78  
  0xfffffa600211b6a0  0x0000000000000010  
  0xfffffa600211b6a8  0x0000000000010286  
  0xfffffa600211b6b0  0xfffffa600211b6c0  
  0xfffffa600211b6b8  0x0000000000000000  
  0xfffffa600211b6c0  0xfffffa8006aa3640  !WDFUSBPIPE 0x0000057ff955c9b8
  0xfffffa600211b6c8  0x0000057ffd184e08  !WDFREQUEST 0x0000057ffd184e08
  0xfffffa600211b6d0  0x0000000000000000  
  0xfffffa600211b6d8  0x0000057ffc51ea18  !WDFMEMORY 0x0000057ffc51ea18
  0xfffffa600211b6e0  0x0000000000000000  

```

--------------------------------

### Example: Displaying Device Object and Node Information

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-devobj

This example demonstrates how to use !devnode to get a device node's information and then use the obtained address with !devobj to inspect the corresponding device object.

```plaintext
kd> !devnode
Dumping IopRootDeviceNode (= 0x80e203b8)
DevNode 0x80e203b8 for PDO 0x80e204f8
 Parent 0000000000   Sibling 0000000000   Child 0x80e56dc8
  InstancePath is "HTREE\ROOT\0"
  State = DeviceNodeStarted (0x308)
  Previous State = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[04] = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[03] = DeviceNodeStarted (0x308)
  StateHistory[02] = DeviceNodeEnumerateCompletion (0x30d)
  StateHistory[01] = DeviceNodeStarted (0x308)
  StateHistory[00] = DeviceNodeUninitialized (0x301)
  StateHistory[19] = Unknown State (0x0)
  .....
  StateHistory[05] = Unknown State (0x0)
  Flags (0x00000131)  DNF_MADEUP, DNF_ENUMERATED, 
                      DNF_IDS_QUERIED, DNF_NO_RESOURCE_REQUIRED
  DisableableDepends = 11 (from children)

kd> !devobj 80e204f8
Device object (80e204f8) is for:
  \Driver\PnpManager DriverObject 80e20610
Current Irp 00000000 RefCount 0 Type 00000004 Flags 00001000
DevExt 80e205b0 DevObjExt 80e205b8 DevNode 80e203b8 
ExtensionFlags (0000000000)  
Device queue is not busy.

```

--------------------------------

### Start KD Server for Five-Computer Scenario

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/two-firewalls

In a five-computer setup, this command starts KD as a server on a machine designated for symbol hosting. It connects to the repeater and uses a named pipe for communication.

```console
kd -server npipe:pipe=randomname -k kdsrv:server=@{tcp:server=127.0.20.20,port=9001,password=Password},trans=@{1394:channel=9} -y SymbolPath
```

--------------------------------

### Example: Get System Registers

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-exdicmd--exdi-command-

This example shows how to use .exdicmd to query system registers with verbose output. It displays the command and the detailed register information returned by the target.

```plaintext
0: kd> .exdicmd target:0:info registers system -v
Target command response: 
NumberOfRegisters: 9

     Name | Value            | Access code
  fs_base | 0000000000000000 | n/a    
  gs_base | fffff8047b907000 | n/a    
  k_gs_base | 000000e7cbdbe000 | n/a    
      cr0 | 0000000080050033 | n/a    
      cr2 | fffff8048454de64 | n/a    
      cr3 | 00000000001ae000 | n/a    
      cr4 | 00000000000006f8 | n/a    
      cr8 | 0000000000000000 | n/a    
     efer | 0000000000000d01 | 0xc0000080

exdiCmd: The function: 'info registers system -v' was completed.
```

--------------------------------

### Start Remote Server with Specific Command and Session Name

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-server-syntax

Example of starting a remote server session with a specific command and a named session. Ensure the command and session name are enclosed in quotes if they contain spaces.

```console
remote /s "i386kd -v" TestSession
```

--------------------------------

### Configure and Start EXDI Debugger

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/exdi-xml-configuration-files

This script configures EXDI settings, installs the EXDI server if necessary, and then starts the debugger. It sets environment variables and debugger arguments based on provided parameters.

```powershell
# Apply defaults for $DebuggerPath before Parameter validation
if (-not $DebuggerPath)
{
    $DebuggerPath = Find-PathToWindbgX
}

Test-ParameterValidation

# look clean up dllhost.exe early since it can hold a lock on files which
# need to be overwritten
if (-not $DontTryDllHostCleanup)
{
    Stop-ExdiContainingDllHosts
}

if (-not $(Test-ExdiServerInstalled))
{
    if (-not $ExdiDropPath)
    {
        throw "ExdiServer is not installed and -ExdiDropPath is not valid"
    }

    $ExdiInstallDir = Join-Path -Path "$([System.IO.Path]::GetDirectoryName($DebuggerPath))" -ChildPath "exdi"
    Install-ExdiServer -InstallFrom "$ExdiDropPath" -InstallTo "$ExdiInstallDir"
}

$SystemRegistersFilepath = Join-Path -Path "$([System.IO.Path]::GetDirectoryName($(Get-ExdiInstallPath)))" -ChildPath "systemregisters.xml"
$ExdiConfigFilepath      = Join-Path -Path "$([System.IO.Path]::GetDirectoryName($(Get-ExdiInstallPath)))" -ChildPath "exdiConfigData.xml"

# Calculate implied parameters
$HeuristicScanSize = if ($PreNTAppDebugging) { "0xffe" } else { "0xfffe" }
$ArchitectureFamily = switch($Architecture)
{
    x64   { "ProcessorFamilyx64" }
    x86   { "ProcessorFamilyx86" }
    arm64 { "ProcessorFamilyARM64" }
}

# Path is evaluated relative to the relevant ExdiTarget's ExdiGdbServerConfigData node in the xml schema
$SettingsToChange = @(
    [pscustomobject]@{ Path = 'GdbServerConnectionParameters.Value.HostNameAndPort' ; Value = "${HostName}:$GdbPort" },
    [pscustomobject]@{ Path = 'ExdiGdbServerTargetData.targetArchitecture'          ; Value = "$Architecture" },
    [pscustomobject]@{ Path = 'ExdiGdbServerTargetData.targetFamily'                ; Value = "$ArchitectureFamily" },
    [pscustomobject]@{ Path = 'ExdiGdbServerTargetData.heuristicScanSize'           ; Value = "$HeuristicScanSize" },
    [pscustomobject]@{ Path = 'displayCommPackets'                                  ; value = "no" }
)
Edit-ExdiConfigFile -ExdiFilePath "$ExdiConfigFilepath" -ExdiTargetType "$ExdiTarget" -XmlSettingPathValueList $SettingsToChange

# Set env vars for debugger
[System.Environment]::SetEnvironmentVariable('EXDI_GDBSRV_XML_CONFIG_FILE',"$ExdiConfigFilepath")
[System.Environment]::SetEnvironmentVariable('EXDI_SYSTEM_REGISTERS_MAP_XML_FILE',"$SystemRegistersFilepath")

$DebuggerArgs = @("-v", "-kx exdi:CLSID={29f9906e-9dbe-4d4b-b0fb-6acf7fb6d014},Kd=Guess,DataBreaks=Exdi")
Write-Verbose "DebuggerPath = $DebuggerPath"
Start-Process -FilePath "$DebuggerPath" -ArgumentList ($DebuggerArgs + $ExtraDebuggerArgs)

```

--------------------------------

### KD Server Output Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-debugging-using-kd

This is the typical output from KD after successfully starting the debugging server, showing the command line to connect from the client.

```plaintext
Server started. Client can connect with any of these command lines
0: <debugger> -remote tcp:Port=5005,Server=YourHostComputer
```

--------------------------------

### Install.cmd Script Parameters

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/symproxy-automated-installation

Example usage of the Install.cmd script, demonstrating how to provide the virtual directory path, username, and password for the Application Pool.

```console
Install.cmd D:\SymStore\Symbols CONTOSO\SymProxyService Pa$$word
```

--------------------------------

### Get Endpoint Data Structure Address using !usb2tree

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd--ehciep

This example demonstrates how to start with the !usb2tree command to find the address of a device extension, which can then be used with !usbhcdext.

```dbgcmd
0: kd> !usbkd.usb2tree
... 
2)!ehci_info ffffe0000206e1a0 !devobj ffffe0000206e050 PCI: VendorId 8086 DeviceId 293c RevisionId 0002 
    RootHub !hub2_info ffffe000024a61a0 !devstack ffffe000024a6050
        Port 1: !port2_info ffffe000026dd000 
        Port 2: !port2_info ffffe000026ddb40 
        Port 3: !port2_info ffffe000026de680 !devstack ffffe00001ec3060
            !device2_info ffffe00001ec31b0 (USB Mass Storage Device: Xxx Corporation)
        Port 4: !port2_info ffffe000026df1c0 


```

--------------------------------

### Specify Address Range by Start and End Address

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/address-and-address-range-syntax

Defines an address range using the starting and ending addresses. This example shows an 8-byte range starting at 0x00001000.

```dbgcmd
0x00001000  0x00001007
```

--------------------------------

### Launch EXDI Debugger with QEMU Target

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/exdi-xml-configuration-files

This is a basic example of calling the startup script to launch the EXDI debugger. It specifies the target, GDB port, and architecture.

```PowerShell
PS>.\Start-ExdiDebugger.ps1 -ExdiTarget "QEMU" -GdbPort 1234 -Architecture x64
```

--------------------------------

### Example Usage of !wdfsearchpath

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wdfkd-wdfsearchpath

An example demonstrating how to use the !wdfkd.wdfsearchpath extension to set the search path to a specific WDK installation directory.

```dbgcmd
kd> !wdfsearchpath C:\WinDDK\7600\tools\tracing\amd64
```

--------------------------------

### Example Service Binary Path

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/preparing-to-debug-the-service-application

An example of a BINARY_PATH_NAME configuration for a service, showing the path to Svchost.exe and its parameters.

```console
%SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork
```

--------------------------------

### Full EXDI Debugger Configuration Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/exdi-xml-configuration-files

This comprehensive example includes specifying the EXDI target, GDB port, architecture, and the path to the EXDI built files, demonstrating a common configuration scenario.

```PowerShell
.
Start-ExdiDebugger.ps1 -ExdiTarget "QEMU" -GdbPort 1234 -Architecture x64 -ExdiDropPath "C:\path\to\built\exdi\files"
```

--------------------------------

### Get Time Travel Debugging Install Location

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-release-notes

Use this PowerShell command to find the installation directory of Time Travel Debugging.

```powershell
ls (Get-AppxPackage | where Name -eq 'Microsoft.TimeTravelDebugging').InstallLocation
```

--------------------------------

### Example: !scsikd.scsiext with PDO

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-scsikd-scsiext

This example shows the output of the !scsikd.scsiext command when the SCSI port extension is specified by a physical device object (PDO). The PDO can be obtained from the DevObj or LUN field in the !minipkd.adapters display.

```dbgcmd
kd> !scsikd.scsiext 816ea030
Scsiport physical device extension at address 816ea0e8
Common Extension:
  Initialized
  DO 0x816ea030  LowerObject 0x816f9a40  SRB Flags 00000000
  Current Power (D0,S0)  Desired Power D-1 Idle 0x8176c780
  Current PnP state 0x0    Previous state 0xff
  DispatchTable f9aee180   UsePathCounts (P0, H0, C0)
Logical Unit Extension:
  Address (2, 0, 1, 0) Claimed  Enumerated Visible
  LuFlags (0x00000000):
  Retry 0x00          Key 0x00000000
  Lock 0x00000000  Pause 0x00000000   CurrentLock: 0x00000000
  HwLuExt 0x8177ce10  Adapter 0x816f9af8  Timeout 0xffffffff
  NextLun 0x00000000  ReadyLun 0x00000000
  Pending 0x00000000  Busy 0x00000000     Untagged 0x00000000
  Q Depth 000 (1628450047)   InquiryData 0x816ea206
  DeviceMap Keys: Target 0x0000d0   Lun 00000000
  Bypass SRB_DATA blocks 4 @ 816ea270   List 816ea810
  RS Irp 8177dd80  Srb @ 816eaa0c   MDL @ 816eaa4c
  Request List @0x816ea1f0 is empty

```

--------------------------------

### Start Debugging Server

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/repeater-examples

Starts a debugging server on BOXA, targeting process 122. This is the first step in a remote debugging setup.

```Console
E:\Debugging Tools for Windows> cdb -server tcp:port=1025,password=Password -p 122 

```

--------------------------------

### Install EXDI Server

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/exdi-xml-configuration-files

Installs the EXDI server by copying necessary DLLs and XML configuration files to a specified directory and registering the server. Requires administrator privileges.

```PowerShell
Function Install-ExdiServer
{
    [CmdletBinding()]
    param
    (
        [string] $InstallFrom,
        [string] $InstallTo
    )
    
    if (-not $(Test-Admin))
    {
        throw "Script needs to be run as an Admin to install exdi software."
    }

    New-Item -ItemType Directory $InstallTo -ErrorAction SilentlyContinue | Write-Verbose
    Copy-Item -Path "$InstallFrom\ExdiGdbSrv.dll" -Destination $InstallTo -ErrorAction SilentlyContinue | Write-Verbose
    Copy-Item -Path "$InstallFrom\exdiConfigData.xml" -Destination $InstallTo -ErrorAction SilentlyContinue | Write-Verbose
    Copy-Item -Path "$InstallFrom\systemregisters.xml" -Destination $InstallTo -ErrorAction SilentlyContinue | Write-Verbose
    regsvr32 /s "$InstallTo\ExdiGdbSrv.dll"

    if ($(Get-ExdiInstallPath) -eq $null)
    {
        throw "Unable to install exdi server"
    }
}
```

--------------------------------

### Packet Pool Allocation Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-pktpools

This example shows the output of the !ndiskd.pktpools command when packet pools are in use. The debugee machine in this example does not have any legacy NDIS 5.x drivers installed so the packet pools are not used. This example is for illustrative purposes only.

```console
3: kd> !ndiskd.pktpools
Pool      Allocator  BlocksAllocated  BlockSize  PktsPerBlock  PacketLength
ffffdf80131d58c0  fffff80f1fbe3e8f   0x1          0x1000     0xa           0x190   ndis!DriverEntry+6af
ffffdf80131d5940  fffff80f1fbe3e71   0x1          0x1000     0xa           0x180   ndis!DriverEntry+691
```

--------------------------------

### Get Process ID using | Command

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/identifying-the-caller-from-the-server-thread

Start a user-mode debugger with the server thread as the target and use the `|` command to get the process ID.

```dbgcmd
0:001> |
  0     id: 3d4 name: rtsvr.exe
```

--------------------------------

### Example: Launching SDKSamples.BackgroundTask with WinDbg

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-a-uwp-app-using-windbg

This is a concrete example of launching the SDKSamples.BackgroundTask UWP application under the debugger using its full package name and background task ID.

```console
windbg.exe -plmPackage Microsoft.SDKSamples.BackgroundTask.CPP_1.0.0.0_x64__8wekyb3d8bbwe -plmBgTaskId {ee4438ee-22db-4cdd-85e4-8ad8a1063523}
```

--------------------------------

### Example of .readmem Command Usage

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-readmem--read-memory-from-file-

This example demonstrates how to copy 10 bytes from 'Myfile' into the target computer's memory, starting at address 1000.

```dbgcmd
.readmem Myfile 1000 10
```

--------------------------------

### Example WinDbg Paths

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/plmdebug

These examples show how to specify the full path to WinDbg.exe, enclosing paths with spaces in quotes.

```shell
"C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\WinDbg.exe"
```

```shell
""C:\Program Files\Debugging Tools for Windows (x64)\WinDbg.exe" -server npipe:pipe=test"
```

--------------------------------

### Example Service Configuration Update

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/preparing-to-debug-the-service-application

This is an example of the `sc config` command used to set the BINARY_PATH_NAME for a service to run in its own isolated group.

```Console
sc config MyService binPath= "%SystemRoot%\System32\svchost.exe -k TempGrp" 

```

--------------------------------

### Get Client Call Info Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-rpcexts-getclientcallinfo

This example shows how to retrieve and display client call information using the !rpcexts.getclientcallinfo extension without any specific filters.

```dbgcmd
0:002> !rpcexts.getclientcallinfo
Searching for call info ...
## PID  CELL ID   PNO  IFSTART  TIDNUMBER CALLID   LASTTIME PS CLTNUMBER ENDPOINT
------------------------------------------------------------------------------
03d4 0000.0001 0000 19bb5061 0000.0000 00000001 0004ca9b 07 0000.0002 1118

```

--------------------------------

### Example: !scsikd.scsiext with FDO

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-scsikd-scsiext

This example shows the output of the !scsikd.scsiext command when the SCSI port extension is specified by a functional device object (FDO). The FDO can be obtained from the DO or DevExt field in the !minipkd.adapters display.

```dbgcmd
kd> !scsikd.scsiext 816f9a40 
Scsiport functional device extension at address 816f9af8
Common Extension:
  Initialized
  DO 0x816f9a40  LowerObject 0x816e8030  SRB Flags 00000000
  Current Power (D0,S0)  Desired Power D-1 Idle 00000000
  Current PnP state 0x0    Previous state 0xff
  DispatchTable f9aee200   UsePathCounts (P0, H0, C0)
Adapter Extension:
  Port 2     IsPnp VirtualSlot HasInterrupt
  LowerPdo 0x816e8030   HwDevExt 0x8170a004   Active Requests 0xffffffff
  MaxBus 0x01   MaxTarget 0x10   MaxLun 0x08
  Port Flags (0x00001000): PD_DISCONNECT_RUNNING
  NonCacheExt 0x81702000  IoBase 0x00002000   Int 0x1a
  RealBus# 0x0  RealSlot# 0x2
  Timeout 0xffffffff   DpcFlags 0x00000000   Sequence 0x00000003
  Srb Ext Header 0x817061a0   No. Requests 0x00000012
  QueueTag BitMap 0x00000000   Hint 0x00000000
  MaxQueueTag 0xfe (@0x816f9c58)
  LuExt Size 0x00000038   SrbExt Size 0x00000188
    SG List Size - Small 17   Large 0
    Emergency  - SrbData 0x816f9830  Blocked List @0x816f9e94
    CommonBuff - Size: 0x00006000    PA: 0x0000000001702000  VA: 0x81702000
    Ke Objects - Int1: 0x8175ba50    Int2: 0x00000000        Dma: 0x816f9340
    Lookaside  - SrbData @ 0x816f9e40 SgList @0x00000000  Remove: @0x00000000
    Resources  - Raw: 0x817ba190     Translated: 0x81709678
    Port Config 8177fde8
    DeviceMap Handles: Port 0000009c    Busses e12d7b38
  Interrupt Data @0x816f9ce4:
    Flags (0x00000000):
    Ready LUN 0x00000000   Wmi Events 0x00000000
    Completed Request List (@0x816f9ce8): 0 entries
    LUN 816ea0e8 @ (  0,  1,  0) c ev  pnp(00/ff) pow(0 ,0) DevObj 816ea030

```

--------------------------------

### Example: Displaying multiple TRBs by Physical Address

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usb3kd-xhci-trb

This example demonstrates displaying four consecutive TRBs starting from a physical address (0x0dced7c00). The '1' indicates a physical address.

```dbgcmd
0: kd> !xhci_trb 0x0dced7c00 4 1

        [  0] ISOCH        0xdced7c00 CycleBit 1 IOC 0 CH 1 BEI 0 InterrupterTarget 1 TransferLength  2688 TDSize  0 TBC 0 TLBPC 2 Frame 0x3D2
        [  1] EVENT_DATA   0xdced7c10 CycleBit 1 IOC 1 CH 0 BEI 1 InterrupterTarget 1 Data 0x194c9bcf001b0001 PacketId 27 Frame 0x194c9bcf TotalBytes 2688
        [  2] ISOCH        0xdced7c20 CycleBit 1 IOC 0 CH 1 BEI 0 InterrupterTarget 1 TransferLength  1352 TDSize  2 TBC 0 TLBPC 2 Frame 0x3D2
        [  3] NORMAL       0xdced7c30 CycleBit 1 IOC 0 CH 1 BEI 0 InterrupterTarget 1 TransferLength  1336 TDSize  0

```

--------------------------------

### !isainfo Command Output Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-isainfo

Shows an example of the output when running the !isainfo command without specifying a card, listing ISA PnP FDO and PDO details.

```plaintext
0: kd> !isainfo
ISA PnP FDO @ 0x867b9938, DevExt @ 0x867b99f0, Bus # 0
Flags (0x80000000)  DF_BUS

  ISA PnP PDO @ 0x867B9818, DevExt @ 0x86595388
  Flags (0x40000818)  DF_ENUMERATED, DF_ACTIVATED, 
                      DF_REQ_TRIMMED, DF_READ_DATA_PORT
```

--------------------------------

### Example: Using !usb3kd.urb with a URB Address

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usb3kd-urb

This example shows how to pass a specific URB address obtained from previous debugging steps to the !usb3kd.urb command to inspect its details.

```dbgcmd
3: kd> !urb 0xfffffa8005a2cbe8

## Dumping URB 0xfffffa8005a2cbe8
------------------------------
Function:         URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER (0x9)
UsbdDeviceHandle: 
    !ucx_device 0xfffffa8005901840
    !xhci_deviceslots 0xfffffa800520d2d0 1

Status:           USBD_STATUS_PENDING (0x40000000)
UsbdFlags:        (0x0)
dt _URB_BULK_OR_INTERRUPT_TRANSFER 0xfffffa8005a2cbe8
PipeHandle:            0xfffffa800596f720
TransferFlags:         (0x1) USBD_TRANSFER_DIRECTION_IN
TransferBufferLength:  0x0
TransferBuffer:        0xfffffa8005a2cc88
TransferBufferMDL:     0xfffffa8005848930


```

--------------------------------

### PoolMon Command to Display Specific Pools

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/using-poolmon-to-find-a-kernel-mode-memory-leak

Use the /i parameter with PoolMon to filter pool tags that start with a specific string. This example filters for tags starting with 'Hid'.

```bash
poolmon /iHid? /g "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\triage\pooltag.txt"
```

--------------------------------

### Example: Setting and Displaying Breakpoints

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-bpcmds--display-breakpoint-commands-

This example demonstrates setting various types of breakpoints (bp, bu, bm, bm /d, ba) and then using .bpcmds to view the commands that created them. It highlights how the output reflects the original command used.

```dbgcmd
0:000> bp notepad!winmain 

0:000> .bpcmds 
bp0 0x00000001`00003340 ;
```

```dbgcmd
0:000> bu myprog!winmain 
breakpoint 0 redefined

0:000> .bpcmds 
bu0 notepad!winmain;
```

```dbgcmd
0:000> bu myprog!LoadFile 

0:000> bp myprog!LoadFile+10 

0:000> bm myprog!openf* 
  3: 00421200 @!"myprog!openFile"
  4: 00427800 @!"myprog!openFilter"

0:000> bm /d myprog!closef* 
  5: 00421600 @!"myprog!closeFile"

0:000> ba r2 myprog!LoadFile+2E 

0:000> .bpcmds
bu0 notepad!winmain;
bu1 notepad!LoadFile;
bp2 0x0042cc10 ;
bu3 @!"myprog!openFile";
bu4 @!"myprog!openFilter";
bp5 0x00421600 ;
ba6 r2 0x0042cc2e ;
```

--------------------------------

### Disassembled Code Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/risks-entailed-when-setting-breakpoints

This example shows disassembled code with instructions of varying lengths. It highlights the importance of identifying the correct starting address for setting breakpoints, especially for multi-byte instructions.

```assembly
770000f1 5e               pop     esi
770000f2 5b               pop     ebx
770000f3 c9               leave
770000f4 c21000           ret     0x10
770000f7 837ddc00         cmp     dword ptr [ebp-0x24],0x0
```

--------------------------------

### SymChk Example with Local Directory

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/using-symchk

This example demonstrates how SymChk searches a specified local directory and its subdirectory based on the executable's extension.

```console
symchk thisdriver.sys /s G:\symbols 
```

--------------------------------

### Example of using DbgRpc on a remote computer

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/using-the-dbgrpc-tool

This example demonstrates how to use the DbgRpc tool to get remote cell information from a server named 'MyServer' using the TCP transport protocol.

```console
G:\\>dbgrpc -s MyServer -p ncacn_ip_tcp -l -P 1e8 -L 0.1
Getting remote cell info ...
Endpoint
Status: Active
Protocol Sequence: LRPC
Endpoint name: OLE18


```

--------------------------------

### Start KD to Analyze a Dump File

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-kd

Use this command to initiate KD and load a kernel-mode dump file for analysis. Specify the symbol path, image path, and the dump file name.

```command-line
kd -y SymbolPath -i ImagePath -z DumpFileName
```

--------------------------------

### Get EXDI Server Installation Path from Registry

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/exdi-xml-configuration-files

Retrieves the installation path of the EXDI server by querying the '(default)' value of the InProcServer32 key in the registry. Used to check if the server is registered.

```PowerShell
Function Get-ExdiInstallPath
{
    Get-ItemPropertyValue -Path "Registry::HKEY_CLASSES_ROOT\CLSID\{29f9906e-9dbe-4d4b-b0fb-6acf7fb6d014}\InProcServer32" -Name "(default)" -ErrorAction SilentlyContinue
}
```

--------------------------------

### Example of Setting and Listing User-Space Breakpoints

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ubl

This example demonstrates setting user-space breakpoints using !ubp, disabling one with !ubd, and then listing all active breakpoints with !ubl. Each line in the !ubl output shows the breakpoint number, status (enabled/disabled), virtual address, physical address, byte position, and memory content at the time of setting.

```debugger
kd> !ubp 8014a131
This command is VERY DANGEROUS, and may crash your system!
If you don't know what you are doing, enter "!ubc *" now!

kd> !ubp 801544f4

kd> !ubd 1

kd> !ubl
 0: e ffffffff`8014a131 (ffffffff`82deb000) 1 ffffffff
 1: d ffffffff`801544f4 (ffffffff`82dff000) 0 ffffffff
```

--------------------------------

### Example: Get Network Information

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-exdicmd--exdi-command-

This example demonstrates how to use .exdicmd with the 'target' parameter to retrieve network information from an OpenOCD target. It shows the command sent and the response received from the target.

```plaintext
0: kd> .exdicmd target:0:info network
Target command response: e1000.0: index=0,type=nic,model=e1000,macaddr=52:54:00:12:34:56
 \ net0: index=0,type=user,net=10.0.2.0,restrict=off
OK
exdiCmd: The function: 'info network' was completed.
```

--------------------------------

### Example Output of !usbkd.doesdumphaveusbdata

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-doesdumphaveusbdata

This example demonstrates the typical output when running !usbkd.doesdumphaveusbdata on a crash dump. It shows checks for various USB data GUIDs and indicates whether data exists or not.

```dbgcmd
1: kd> !analyze -v
*** ...
BUGCODE_USB_DRIVER (fe) 
...
1: kd> !usbkd.doesdumphaveusbdata

Retrieving crashdump information Please Wait...

Checking for GuidUsbHubPortArrayData information...
There is no data for this GUID in the mini dump.
No data to print  

Checking for GuidUsbHubExt information...
There is no data for this GUID in the mini dump.
No data to print  

Checking for GuidUsbPortLog information...
GuidUsbPortLog Exists with PORT Log Size = 8000 

Checking for GuidUsbPortContextData information...
GuidUsbPortContextData Exists with Data Length = 4c8 

Checking for GuidUsbPortExt information...
GuidUsbPortExt Exists (DEVICE_EXTENSION + DeviceDataSize ) = 2250

```

--------------------------------

### Example Output of !blockeddrv

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-blockeddrv

This is an example of the output generated by the !blockeddrv command, showing driver names, their status codes, and associated GUIDs. The status '0:' typically indicates the driver is blocked.

```plaintext
kd> !blockeddrv
Driver:      Status    GUID
afd.sys      0:        {00000008-0206-0001-0000-000030C964E1}
agp440.sys   0:        {0000005C-175A-E12D-5000-010020885580}
atapi.sys    0:        {0000005C-B04A-E12E-5600-000020885580}
audstub.sys  0:        {0000005C-B04A-E12E-5600-000020885580}
Beep.SYS     0:        {0000005C-B04A-E12E-5600-000020885580}
Cdfs.SYS     0:        {00000008-0206-0001-0000-000008F036E1}
.....
```

--------------------------------

### IRQL Transition Log Example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-verifier

This example shows consecutive entries in the IRQL transition log on 64-bit Windows, illustrating a case where information about an IRQL raise is missing. This output is generated by the 'dbgcmd' command.

```text
Thread:             fffffa80068c9400
Old irql:           0000000000000002
New irql:           0000000000000000
Processor:          0000000000000002
Time stamp:         0000000000000857

    fffff8800140f12a ndis!ndisNsiGetInterfaceInformation+0x20a
    fffff88001509478 NETIO!NsiGetParameterEx+0x178
    fffff88005f062f2 nsiproxy!NsippGetParameter+0x24a
    fffff88005f086db nsiproxy!NsippDispatchDeviceControl+0xa3
    fffff88005f087a0 nsiproxy!NsippDispatch+0x48

Thread:             fffffa80068c9400
Old irql:           0000000000000002
New irql:           0000000000000002
Processor:          0000000000000002
Time stamp:         0000000000000857

    fffff8800140d48d ndis!ndisReferenceTopMiniportByNameForNsi+0x1ce
    fffff8800140f072 ndis!ndisNsiGetInterfaceInformation+0x152
    fffff88001509478 NETIO!NsiGetParameterEx+0x178
    fffff88005f062f2 nsiproxy!NsippGetParameter+0x24a
    fffff88005f086db nsiproxy!NsippDispatchDeviceControl+0xa3

```

--------------------------------

### !ndiskd.ndiskdversion Example Output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-ndiskdversion

This example shows the typical output when running the !ndiskd.ndiskdversion command, detailing the NDISKD version, build type, debugger CPU, and status of features like hyperlinks, Unicode, and debug mode.

```console
0: kd> !ndiskd.ndiskdversion
    NDISKD Version     17.08.00 (NDISKD codename "We'll deploy IPv6 real soon now")
    Build              Release
    Debugger CPU       AMD64
    Hyperlinks (DML)   Enabled
    Unicode            Enabled
    Debug NDISKD       Disabled

```

--------------------------------

### Example Usage of !ndiskd.netring

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-netring

This example shows how to use the !ndiskd.netring extension to view the details of a specific NET_RING structure. The output includes indices, ownership, and element information.

```console
0: kd> !ndiskd.netring ffff8b82f8e75000 

NET RING               ffff8b82f8e75000

Begin index            000
Next index             000
End index              0x2
Reserved by OS         000
Element stride         0x40
Element index mask     0x7f

Number of elements     0x80
Owned by OS            0x7e
Owned by Client        0x2
```

--------------------------------

### Using !hidpdo and !hidkd.hidppd

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-hidkd-hidppd

This example demonstrates how to first use !hidpdo to find the address of a HIDP_PREPARSED_DATA structure, and then use !hidkd.hidppd with that address to display the preparsed data. This is useful for inspecting HID device capabilities.

```dbgcmd
0: kd> !hidpdo 0xffffe000029f6060
## PDO 0xffffe000029f6060  (!devobj/!devstack)

  Collection Num  : 1
  Name            : \Device\_HID00000000#COLLECTION00000001
  ...
  Pre-parsed Data : 0xffffe000029d1010
  ...

0: kd> !hidkd.hidppd 0xffffe000029d1010
Reading preparsed data...
Preparsed Data at 0xffffe000029d1010  

## Summary

  UsagePage             : Vendor-defined (0xFFA0)
  Usage                 : 0x01
  Report Length         : 0x2(Input) 0x2(Output) 0x0(Feature)
  Link Collection Nodes : 2
  Button Caps           : 0(Input) 0(Output) 0(Feature)
  Value Caps            : 1(Input) 1(Output) 0(Feature)
  Data Indices          : 1(Input) 1(Output) 0(Feature)

## Input Value Capability #0

  Report ID         : 0x0
  Usage Page        : Vendor-defined (0xFFA1)
  Bit Size          : 0x8
  Report Count      : 0x1
  ...

```

--------------------------------

### Start Debugging Server with Password

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-endsrv--end-debugging-server-

This example shows how to start a debugging server with a password using the npipe protocol. It's important to note that passwords are not encrypted with TCP, NPIPE, or COM protocols.

```dbgcmd
0:000> .server npipe:pipe=tiger,password=Password
Server started with 'npipe:pipe=tiger,password=Password'
```

--------------------------------

### AgeStore Command Syntax Examples

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/agestore-command-line-options

These examples show the basic syntax for using AgeStore with different criteria: date, number of days, and size. The PathSpec and Options parameters can be included in any order.

```console
agestore [PathSpec] -date=Month-Day-Year Options 

agestore [PathSpec] -days=NumberOfDays Options 

agestore [PathSpec] -size=SizeRemaining Options 

agestore [PathSpec] -size Options 

agestore -? 

```

--------------------------------

### DevCon Update Command Arguments

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-a-device-installation-co-installer

Use this command with DevCon to update a device installation using its INF file and hardware ID. Ensure the 'Start directory' is set to your device installation package path.

```text
update INFFile HardwareID 

```

--------------------------------

### Sample Remote Client Usage

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-client-syntax

Illustrates various ways to use the remote client command-line syntax, including basic connections, specifying session names, setting display options, and using color files.

```console
remote /c Server01 TestSession

```

```console
remote /c Domain1\ComputerA0 "cmd" "My Remote Session"

```

```console
remote /c Server01 TestSession /L 50 /f black /b white /k c:\remote_file.txt

```

```console
remote /q Server01

```

--------------------------------

### Get help on a specific ACXKD command

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-acxkd

To get detailed information about a specific ACXKD command, append the command name to the !help command. For example, use '!help acxdevice' to learn more about the !acxdevice command.

```dbgcmd
0: kd> !acxkd.help acxdevice
!acxdevice <device>
  <device> - ACXDEVICE handle
Dump a ACXDEVICE object.

```

--------------------------------

### Example Bus Parameters

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/setting-up-a-usb-3-0-debug-cable-connection

An example of setting the bus parameters using decimal values for bus, device, and function numbers.

```cmd
bcdedit /set "{dbgsettings}" busparams 48.0.0

```

--------------------------------

### Example: List logs for usbxhci driver

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-rcdrkd-rcdrloglist

This example demonstrates how to list all recorder logs for the USB 3.0 host controller driver (usbxhci.sys). The output shows the command to dump each log, its ID, and its size.

```dbgcmd
3: kd> !rcdrloglist usbxhci
Log dump command                           Log ID                   Size
================                           ======                   ====
!rcdrlogdump  usbxhci -a fffffa8005ff2b60  03 SLT02 DCI04           1024
!rcdrlogdump  usbxhci -a fffffa8005ff2010  03 SLT02 DCI03           1024
!rcdrlogdump  usbxhci -a fffffa8005b36010  03 SLT01 DCI03           1024
!rcdrlogdump  usbxhci -a fffffa8005b379e0  03 SLT01 DCI04           1024
!rcdrlogdump  usbxhci -a fffffa8005b33350  03 SLT02 DCI01           1024
!rcdrlogdump  usbxhci -a fffffa8005b2bb60  03 SLT01 DCI01           1024
!rcdrlogdump  usbxhci -a fffffa8005a2bb60  03 CMD                   1024
!rcdrlogdump  usbxhci -a fffffa8005a1ab60  03 INT00                 1024
!rcdrlogdump  usbxhci -a fffffa8005085330  03 RUNDOWN               512
!rcdrlogdump  usbxhci -a fffffa8005311780  03 1033 0194             1024

```

--------------------------------

### Specify Address Range by Address and Length

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/address-and-address-range-syntax

Uses the 'L Size' specifier to define a range starting at a given address with a specific length. This example shows a range starting at 0x80000000 with a length of 32 (0x20).

```dbgcmd
80000000 L20
```