WinDbg

https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds
Admin
WinDbg is a multipurpose debugger for Windows designed to analyze crash dumps, debug live user-mode...
Tokens:313,960
Snippets:2,709
Trust Score:10
Update:6 days ago
Show doc for...
Tokens:
Raw
### Tracelog command to start a trace session with -kd and -lowcapacity

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wmitrace-dynamicprint

Example Tracelog command to start a trace session with the -kd parameter (to send messages to the debugger) and -lowcapacity (to use a single buffer, ensuring events are displayed in order).

```text
Tracelog MySession -kd -lowcapacity

```

--------------------------------

### Example: Get endpoint data address using !usb2tree, !usbhcdext, !usblist, and !_ehciep

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd--ehciep

This example shows the full workflow to obtain and display a usbehci!_ENDPOINT_DATA structure. Start with !usb2tree to get the device extension address, then use !usbhcdext to find the GlobalEndpointList, use !usblist to list endpoints and identify the _ENDPOINT_DATA address, and finally pass that address to !_ehciep.

```dbgcmd
0: kd> !usbkd.usb2tree
...
2)!ehci_info ffffe0000206e1a0 !devobj ffffe0000206e050 PCI: VendorId 8086 DeviceId 293c RevisionId 0002 
    RootHub !hub2_info ffffe000024a61a0 !devstack ffffe000024a6050
        Port 1: !port2_info ffffe000026dd000 
        Port 2: !port2_info ffffe000026ddb40 
        Port 3: !port2_info ffffe000026de680 !devstack ffffe00001ec3060
            !device2_info ffffe00001ec31b0 (USB Mass Storage Device: Xxx Corporation)
        Port 4: !port2_info ffffe000026df1c0 

```

```dbgcmd
0: kd> !usbkd.usbhcdext ffffe0000206e1a0
...
DeviceHandleList: !usblist ffffe0000206f3b8, DL 
DeviceHandleDeletedList: !usblist ffffe0000206f3c8, DL [Empty]
GlobalEndpointList: !usblist ffffe0000206f388, EP 
...

```

```dbgcmd
0: kd> !usblist ffffe0000206f388, EP 
list: ffffe0000206f388 EP
...
dt usbport!_HCD_ENDPOINT ffffe000026dc970  !usbep ffffe000026dc970
common buffer bytes 0x00003000 (12288) @ va 0000000021e6e000 pa 00000000d83c9000
Device Address: 0x01, ep 0x81 Bulk In Flags: 00000041 dt _USB_ENDPOINT_FLAGS ffffe000026dc990
... usbehci!_ENDPOINT_DATA ffffe000026dcc38
...

```

```dbgcmd
0: kd> !usbkd._ehciep ffffe000026dcc38
*USBEHCI
dt usbehci!_ENDPOINT_DATA ffffe000026dcc38
Flags: 0x00000000
dt usbehci!_HCD_QUEUEHEAD_DESCRIPTOR ffffd00021e6e080
*HwQH ffffd00021e6e080
HwQH
     HwQH.HLink dea2e002
     HwQH.EpChars 02002101
         DeviceAddress: 0x1
         IBit: 0x0
         EndpointNumber: 0x1
         EndpointSpeed: 0x2 HcEPCHAR_HighSpeed
         DataToggleControl: 0x0
         HeadOfReclimationList: 0x0
         MaximumPacketLength: 0x200 - 512
   ...
current slot 0000000000000000
slot[0] dt usbehci!_ENDPOINT_SLOT ffffe000026dcdb8 - slot_NotBusy
----
     ffffd00021e6e100
     dt usbehci!_HCD_TRANSFER_DESCRIPTOR ffffd00021e6e100
    tdphys: d83c9100'200 txlen 00000000 tx ffffd00000000041 flags 6d4e695d  _BUSY _SLOT_RESET
    Next_qTD: d83c9200'd83c9180 AltNext_qTD 77423c00'41 
    NextTD: ffffd00021e6e200 AltNextTD ffffd00021e6e180 SlotNextTd ffffd00021e6e200 tok 00000c00  Xbytes x0 (0)
.
     ffffd00021e6e200
     dt usbehci!_HCD_TRANSFER_DESCRIPTOR ffffd00021e6e200
    tdphys: d83c9200'5000 txlen 00000000 tx ffffd00000000041 flags 6d4e695d  _BUSY _SLOT_RESET
    Next_qTD: d83c9280'd83c9180 AltNext_qTD 77423c00'41 
    NextTD: ffffd00021e6e280 AltNextTD ffffd00021e6e180 SlotNextTd ffffd00021e6e280 tok 00000c00  Xbytes x0 (0)
...

```

--------------------------------

### !storagekd.storhelp example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-storagekd-storhelp

Example output from the !storagekd.storhelp command, listing available Storage Debugger Extension commands.

```dbgcmd
# Storage Debugger Extension
===============================================
## General Commands
----------------
!storhelp    - Displays complete help of the commands provided in this KD extension
!storclass   - Dumps all class devices managed by classpnp
!storadapter - Dumps all adapters managed by Storport
!storunit    - Dumps all disks managed by Storport

## STORPORT specific commands
--------------------------
!storlogirp <args>     - displays internal log entries that reference the specified IRP.
                         See '!storhelp storlogirp' for details.
!storloglist <args>    - displays internal log entries. See '!storhelp storloglist' for details.
!storlogsrb <args>     - displays internal log entries that reference the specified SRB.
                         See '!storhelp storlogsrb' for details.
!storsrb <address>     - display details for the specified SCSI or STORAGE request block
```

--------------------------------

### !ndiskd.ndis output example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-ndis

Example output showing a Checked Ndis build on the debugee machine.

```console
0: kd> !ndiskd.ndis
Checked Ndis

```

--------------------------------

### !scsikd.classext example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-scsikd-classext

Example output from the !scsikd.classext extension when no device is specified. It lists all class PnP extensions with device information and ends with a usage line.

```dbgcmd
0: kd> !scsikd.classext
  ' !scsikd.classext 8633e3f0 '   (             ) "IBM     " / "DDYS-T09170M    " / "S93E" / "        XBY45906"
  ' !scsikd.classext 86347b48 '   (paging device) "IBM     " / "DDYS-T09170M    " / "S80D" / "        VDA60491"
  ' !scsikd.classext 86347360 '   (             ) "UNISYS  " / "003451ST34573WC " / "5786" / "HN0220750000181300L6"
  ' !scsikd.classext 861d1898 '   (             ) "" / "MATSHITA CD-ROM CR-177" / "7T03" / ""

 usage: !classext <class fdo> <level [0-2]> 

```

--------------------------------

### !usbkd.usbver example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbver

Example output of the !usbkd.usbver command, showing the USBD interface version and the USB stack version.

```dbgcmd
1: kd> !usbkd.usbver

USBD VER 600 USB stack is VISTA

```

--------------------------------

### .netuse example connecting to a share

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-netuse--control-network-connections-

Example usage of .netuse to connect drive m: to \\myserver\myshare with empty user and password parameters.

```dbgcmd
0:000> .netuse "m:" "\\myserver\myshare" "" "" 

```

--------------------------------

### !storagekd.storadapter example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-storagekd-storadapter

Example of the !storagekd.storadapter display output.

```dbgcmd
# STORPORT adapters:

```

--------------------------------

### !ndiskd.compartments output example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-compartments

Example output from running !ndiskd.compartments, showing a single primary compartment with its ID, loopback network, loopback interface, and networks list.

```console
3: kd> !ndiskd.compartments
    Compartment        ffffdf80139b9940
    ID                 1
    Loopback Network   ffffdf80139b8900
    Loopback Interface ffffdf80139b6a20
    Networks:
                       ffffdf80139b8900    [Unnamed network]

```

--------------------------------

### Example: !usbkd.usb2tree output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbtt

Example output from the !usbkd.usb2tree command, showing the address of the device extension of the FDO as the argument of the DML command !ehci_info ffffe00001ca11a0.

```dbgcmd
0: kd> !usbkd.usb2tree
...
2)!ehci_info ffffe00001ca11a0 !devobj ffffe00001ca1050 PCI: VendorId 8086 DeviceId 293c RevisionId 0002 
...

```

--------------------------------

### !usbkd.usb2 command example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usb2

Example output from the !usbkd.usb2 command, showing USB endpoint scheduling information. The device extension address is passed as the argument.

```dbgcmd
0: kd> !usbkd.usb2 ffffe00001ca11a0

Sig: HFDO
Hcd FDO Extension:
----------
----------
dt usbport!_HCD_ENDPOINT ffffe0000212d970  !usbep ffffe0000212d970
    Tt 0000000000000000 Device Address: 0x00, ep 0x81 Interrupt In
    dt _USB2LIB_ENDPOINT_CONTEXT ffffe000023b60f0    dt _USB2_EP ffffe000023b6100
    Period,offset,Ordinal(32,0,0)   smask,cmask(00,00  ........ , ........) maxpkt 1

```

--------------------------------

### IRQL transition log example (64-bit Windows)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-verifier

Shows two consecutive entries from the IRQL transition log for Processor 2, illustrating that the log is not always complete on 64-bit Windows. The first entry shows IRQL going from 2 to 0, the second from 2 to 2, with missing information on how the IRQL was raised from 0 to 2.

```dbgcmd
Thread:             fffffa80068c9400
Old irql:           0000000000000002
New irql:           0000000000000000
Processor:          0000000000000002
Time stamp:         0000000000000857

    fffff8800140f12a ndis!ndisNsiGetInterfaceInformation+0x20a
    fffff88001509478 NETIO!NsiGetParameterEx+0x178
    fffff88005f062f2 nsiproxy!NsippGetParameter+0x24a
    fffff88005f086db nsiproxy!NsippDispatchDeviceControl+0xa3
    fffff88005f087a0 nsiproxy!NsippDispatch+0x48

Thread:             fffffa80068c9400
Old irql:           0000000000000002
New irql:           0000000000000002
Processor:          0000000000000002
Time stamp:         0000000000000857

    fffff8800140d48d ndis!ndisReferenceTopMiniportByNameForNsi+0x1ce
    fffff8800140f072 ndis!ndisNsiGetInterfaceInformation+0x152
    fffff88001509478 NETIO!NsiGetParameterEx+0x178
    fffff88005f062f2 nsiproxy!NsippGetParameter+0x24a
    fffff88005f086db nsiproxy!NsippDispatchDeviceControl+0xa3

```

--------------------------------

### !ndiskd.pktpools example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-pktpools

Example output from running !ndiskd.pktpools on a system with no legacy NDIS 5.x drivers installed. The packet pool handles are not clickable because NDIS does not use packet pools starting with NDIS 6.0.

```console
3: kd> !ndiskd.pktpools
Pool      Allocator  BlocksAllocated  BlockSize  PktsPerBlock  PacketLength
ffffdf80131d58c0  fffff80f1fbe3e8f   0x1          0x1000     0xa           0x190   ndis!DriverEntry+6af
ffffdf80131d5940  fffff80f1fbe3e71   0x1          0x1000     0xa           0x180   ndis!DriverEntry+691

```

--------------------------------

### List all open bindings with !ndiskd.mopen

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-mopen

Example output from running !ndiskd.mopen with no parameters, showing a list of all open bindings between miniports and protocols. The example highlights the binding between Microsoft ISATAP Adapter #2 and TCPIP6TUNNEL with handle ffff8083e56b8110.

```console
3: kd> !ndiskd.mopen
Open ffff8083e56b8110
  Miniport: ffff8083e02ce1a0 - Microsoft ISATAP Adapter #2
  Protocol: ffff8083e1a95c00 - TCPIP6TUNNEL

Open ffff8083e11902c0
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e3e8f6b0 - RSPNDR

Open ffff8083e55f3010
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e0114730 - NDISUIO

Open ffff8083e15537d0
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e3e90800 - LLTDIO

Open ffff8083e3926010
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e3e90c10 - MSLLDP

Open ffff8083e0c565a0
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e11cec10 - TCPIP

Open ffff8083e504c770
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e19bfc10 - TCPIP6

```

--------------------------------

### Example: Get FDO address with !usb2tree

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-ehci-info-from-fdo

Example output from the !usb2tree command, used to obtain the address of the FDO of the USB host controller. In this example, the FDO address is ffffe00001ca1050.

```dbgcmd
0: kd> !usbkd.usb2tree

EHCI MINIPORT(s) dt usbport!_USBPORT_MINIPORT_DRIVER ffffe00001f48bd0

1)!ehci_info ffffe00001ca11a0 !devobj ffffe00001ca1050 PCI: VendorId 8086 DeviceId 293c RevisionId 0002 
...

```

--------------------------------

### Illustrate /0, /1, and /2 options

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/x--examine-symbols-

Shows the output of the x command with the /0, /1, and /2 options for the pattern 'MyApp!Add*'. /0 displays only addresses, /1 displays only symbol names, and /2 displays both addresses and names. These options are useful for piping output to the .foreach command.

```dbgcmd
0:000:x86> x /0 MyApp!Add*
00b51410          
00b513d0 
      
0:000:x86> x /1 MyApp!Add*
MyApp!AddThreeIntegers
MyApp!AddTwoIntegers

0:000:x86> x /2 MyApp!Add*
00b51410          MyApp!AddThreeIntegers
00b513d0          MyApp!AddTwoIntegers

```

--------------------------------

### Launch and record a Windows app with a passed parameter (default mode)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util

Starts ping with a parameter, omitting the -launch option because it is the default mode. The trace file is named ping01.run.

```console
C:\TTD> TTD.exe ping.exe msn.com
Launching 'ping.exe msn.com'
    Recording process (PID:24044) on trace file: C:\TTD\ping01.run

Pinging msn.com [204.79.197.219] with 32 bytes of data:
Reply from 204.79.197.219: bytes=32 time=22ms TTL=118
Reply from 204.79.197.219: bytes=32 time=21ms TTL=118
Reply from 204.79.197.219: bytes=32 time=25ms TTL=118
Reply from 204.79.197.219: bytes=32 time=21ms TTL=118

Ping statistics for 204.79.197.219:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 21ms, Maximum = 25ms, Average = 22ms
ping.exe(x64) (PID:24044): Process exited with exit code 0 after 3390ms
  Full trace dumped to C:\TTD\ping01.run

```

--------------------------------

### g- command to reach start of trace

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-replay

Use the g- command to execute backwards until an event or the beginning of the TTD trace is reached. In this example, the start of the trace is reached, and the output shows the 'TTD: Start of trace reached.' message.

```dbgcmd
0:000> g-
TTD: Start of trace reached.
(3f78.4274): Break instruction exception - code 80000003 (first/second chance not available)
Time Travel Position: 29:0
ntdll!ZwTestAlert+0x14:
00007ffc`61f789d4 c3              ret

```

--------------------------------

### Example: Get transfer context address using !_ehciep

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd--ehcitd

Example output from the !_ehciep command showing how to obtain the address of a usbehci!_TRANSFER_CONTEXT structure. The address ffffd00021e65100 is passed to !_ehcitd.

```dbgcmd
0: kd> !_ehciep ffffe000001ab618
*USBEHCI
dt usbehci!_ENDPOINT_DATA ffffe000001ab618
Flags: 0x00000000
dt usbehci!_HCD_QUEUEHEAD_DESCRIPTOR ffffd00021e65080
*HwQH ffffd00021e65080
HwQH
     HwQH.HLink dea2e002
     HwQH.EpChars 02002201
         DeviceAddress: 0x1
         IBit: 0x0
         EndpointNumber: 0x2
    ...
slot[0] dt usbehci!_ENDPOINT_SLOT ffffe000001ab798 - slot_NotBusy
----
     ffffd00021e65100
     dt usbehci!_HCD_TRANSFER_DESCRIPTOR ffffd00021e65100
    ....

```

--------------------------------

### Get EHCI controller operational registers address with !usbkd.usbhcdlist

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd--ehciregs

Example output from !usbkd.usbhcdlist showing how to find the address of a usbehci!_HC_OPERATIONAL_REGISTER structure. The address ffffd000228bf020 is used in the next example.

```dbgcmd
0: kd> !usbkd.usbhcdlist
MINIPORT List @ fffff80001e5bbd0

## List of EHCI controllers

!drvobj ffffe00001fd33a0 dt USBPORT!_USBPORT_MINIPORT_DRIVER ...
...
02. Xxxx Corporation PCI: VendorID Xxxx DeviceID Xxxx RevisionId 0002
    !devobj ffffe00001ca1050
    !ehci_info ffffe00001ca11a0
    Operational Registers ffffd000228bf020

```

--------------------------------

### !storagekd.storclass output example (no arguments)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-storagekd-storclass

Example output when !storagekd.storclass is run without arguments, showing a list of classpnp extensions. The output includes usage instructions for the command.

```dbgcmd
Storage class devices:

* !storclass fffffa80043dc060 [1,2] ST3160812AS Paging Disk       
  !storclass fffffa8006581740 [1,2] Msft Virtual Disk Disk       

Usage: !storclass <class device> <level [0-2]>

```

--------------------------------

### !ndiskd.netring example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-netring

Example output from running !ndiskd.netring with a NET_RING handle. The output shows the ring's begin, next, and end indices, element stride, element index mask, number of elements, and ownership counts.

```console
0: kd> !ndiskd.netring ffff8b82f8e75000 

NET RING               ffff8b82f8e75000

Begin index            000
Next index             000
End index              0x2
Reserved by OS         000
Element stride         0x40
Element index mask     0x7f

Number of elements     0x80
Owned by OS            0x7e
Owned by Client        0x2

```

--------------------------------

### Get device handle addresses using !usbkd.usblist

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbdevh

Example output from the !usbkd.usblist command, showing the addresses of usbport!_USBD_DEVICE_HANDLE structures.

```dbgcmd
0: kd> !usblist ffffe00001ca23b8, DL
list: ffffe00001ca23b8 DL
----------
!usbdevh ffffe000020f9590
SSP [IdleReady] (0)
...

```

--------------------------------

### !ndiskd.nbl example - display NBL information

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-nbl

Example output from running !ndiskd.nbl with an NBL handle. Shows the NBL address, next NBL, first NET_BUFFER, source adapter, flags, and available actions such as walking the NBL chain, dumping data payload, showing out-of-band information, and reviewing NBL history.

```console
2: kd> !ndiskd.nbl ffffdf80149524a0
    NBL                ffffdf80149524a0    Next NBL           NULL
    First NB           ffffdf8014952610    Source             ffffdf80140c71a0 - Microsoft Kernel Debug Network Adapter
    Flags              INDICATED, RETURNED, NBL_ALLOCATED, PROTOCOL_020_0,
                       PROTOCOL_200_0

    Walk the NBL chain                     Dump data payload
    Show out-of-band information
    Review NBL history

```

--------------------------------

### List HCD_ENDPOINT structures with !usblist

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbep

Use !usblist with the GlobalEndpointList address to get addresses of _HCD_ENDPOINT structures. The output shows an example address ffffe000020f6970.

```dbgcmd
0: kd> !usblist ffffe00001ca2388, EP

list: ffffe00001ca2388 EP
----------
dt usbport!_HCD_ENDPOINT ffffe000020f6970  !usbep ffffe000020f6970
Device Address: 0x00, ep 0x00 Control  Flags: 00000002 dt _USB_ENDPOINT_FLAGS ffffe000020f6990
dt usbport!_ENDPOINT_PARAMETERS ffffe000020f6b18    RootHub Endpoint
...

```

--------------------------------

### Get device handle list using !usbkd.usbhcdext

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbdevh

Example output from the !usbkd.usbhcdext command, showing the device handle list for a USB host controller.

```dbgcmd
0: kd> !usbkd.usbhcdext ffffe00001ca11a0

HC Flavor 1000  FDO ffffe00001ca1050
Root Hub: FDO ffffe00002320050 !hub2_info ffffe000023201a0
Operational Registers ffffd000228bf020
Device Data ffffe00001ca2da0
dt USBPORT!_FDO_EXTENSION ffffe00001ca15a0
DM Timer Flags ffffe00001ca16d4
FDO Flags ffffe00001ca16d0
HCD Log ffffe00001ca11a0

DeviceHandleList: !usblist ffffe00001ca23b8, DL 
DeviceHandleDeletedList: !usblist ffffe00001ca23c8, DL [Empty]
...

```

--------------------------------

### Use x /0 output with .foreach

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/x--examine-symbols-

Shows how to use the output of the x command with the /0 option as input to the .foreach command. The example iterates over symbols matching 'MyApp!*MySym*' and echoes each address plus 0x18.

```dbgcmd
.foreach ( place { x /0 MyApp!*MySym*} ) { .echo ${place}+0x18 }

```

--------------------------------

### !ndiskd.nbl -data output showing NET_BUFFER handle

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-nb

Output from !ndiskd.nbl -data that shows the NET_BUFFER handle ffffdf8014952610. This is the starting point for the subsequent !ndiskd.nb examples.

```console
2: kd> !ndiskd.nbl ffffdf80149524a0 -data
NET_BUFFER ffffdf8014952610

```

--------------------------------

### !wsle example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wsle

Example output from an x86 target running Windows Server 2003. Shows the working set list header and WSLE details when flag 3 (0x1 and 0x2) is used.

```dbgcmd
kd> !wsle 3

Working Set @ c0503000
    FirstFree:       a7  FirstDynamic:          4
    LastEntry      23d  NextSlot:         4  LastInitialized      259
    NonDirect       65  HashTable:        0  HashTableSize:         0

Reading the WSLE data...

Virtual Address           Age  Locked  ReferenceCount
        c0300203          0        1        1
        c0301203          0        1        1
        c0502203          0        1        1
        c0503203          0        1        1
        c01ff201          0        0        1
        77f74d19          3        0        1
        7ffdfa01          2        0        1
        c0001201          0        0        1

.....

Reading the WSLE data...
Valid WSLE entries = 0xa7
found end @ wsle index 0x259

.....

```

--------------------------------

### Get transfer list with !usbkd.usbhcdext

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbtx

Example output from !usbkd.usbhcdext showing the I/O transfer list. The address ffffe0000653401c is the address of an _HCD_TRANSFER_CONTEXT structure to pass to !usbtx.

```dbgcmd
0: kd> !usbkd.usbhcdext ffffe00001c8f1a0
...
## I/O TRANSFER LIST(s)

1.) Transfer Request Priority List: (TxQueued) Type: 0-NotSplit, 1-Parent, 2-Child
    --------------------------------------------------------------------------------
    [000]!usbtx ffffe0000653401c !usbep ffffe00004730c60 !irp ffffe00004221220 State: (7)TX_Mapped_inMp
        Priority: 0, Type: 0, Flags= 0000000a, SequenceNum: 10, SplitIdx: 0
        InLen: 4096, OutLen: 0 Status: USBD_STATUS_PENDING (0x40000000)
    ...

```

--------------------------------

### !minipkd.adapters example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-minipkd-adapters

Example output of the !minipkd.adapters command. Shows two adapters and their associated LUNs with flags such as c (claimed), e (enumerated), v (visible), p (paging), and d (dump).

```dbgcmd
0: kd> !minipkd.adapters
Adapter \Driver\lp6nds35     DO 86334a70         DevExt 86334b28
Adapter \Driver\adpu160m     DO 8633da70         DevExt 8633db28
 LUN 862e60f8 @(0,0,0) c ev     pnp(00/ff) pow(0,0) DevObj 862e6040
 LUN 863530f8 @(0,1,0) c ev p d pnp(00/ff) pow(0,0) DevObj 86353040
 LUN 862e50f8 @(0,2,0) c ev     pnp(00/ff) pow(0,0) DevObj 862e5040
 LUN 863520f8 @(0,6,0)   ev     pnp(00/ff) pow(0,0) DevObj 86352040
Adapter \Driver\adpu160m     DO 86376040         DevExt 863760f8

```

--------------------------------

### Check valid memory range with $vvalid

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/masm-numbers-and-operators

Uses the $vvalid operator to check if a memory range is valid. The example checks a range starting at 0x00007ff60f620000 with length 0xFFFF, returning 1 (valid).

```dbgcmd
0:000> ? $vvalid(0x00007ff60f620000, 0xFFFF)
Evaluate expression: 1 = 00000000`00000001
```

--------------------------------

### Search for DWORD value 'H' with s -d

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/s--search-memory-

Example of using the s command with the -d flag to search for a DWORD value 'H' in the memory range starting at @rsp with length L1000000. The output shows the addresses and hex dump of matches.

```dbgcmd
0:000> s -d @rsp L1000000 'H'  
0000003f`ff07ec00  00000048 00000000 500c0163 00000000  H.......c..P....
0000003f`ff07ec50  00000048 00000000 00000080 00000000  H...............
0000003f`ff07efc0  00000048 00000000 400c0060 00000000  H.......`..@....

```

--------------------------------

### Example output of !logonsession 0 on a free build

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-logonsession

Example output from the !logonsession extension on a free build when LUID is 0, dumping all logon sessions. Shows session handles, logon IDs, and reference counts.

```dbgcmd
kd> !logonsession 0

Dumping all logon sessions.

** Session   0 = 0x0
   LogonId     = {0x0 0x0}
   References  = 0
** Session   1 = 0x8ebb50
 LogonId     = {0xe9f1 0x0}
   References  = 21
** Session   2 = 0x6e31e0
   LogonId     = {0x94d1 0x0}
   References  = 1
** Session   3 = 0x8ecd60
   LogonId     = {0x6b31 0x0}
   References  = 0
** Session   4 = 0xe0000106
   LogonId     = {0x0 0x0}
   References  = 0
** Session   5 = 0x0
   LogonId     = {0x0 0x0}
   References  = 0
** Session   6 = 0x8e9720
   LogonId     = {0x3e4 0x0}
   References  = 6
** Session   7 = 0xe0000106
   LogonId     = {0x0 0x0}
   References  = 0
** Session   8 = 0xa2e160
   LogonId     = {0x3e5 0x0}
   References  = 3
** Session   9 = 0xe0000106
   LogonId     = {0x0 0x0}
   References  = 0
** Session  10 = 0x3ca0
   LogonId     = {0x3e6 0x0}
   References  = 2
** Session  11 = 0xe0000106
   LogonId     = {0x0 0x0}
   References  = 0
** Session  12 = 0x1cd0
   LogonId     = {0x3e7 0x0}
   References  = 33
** Session  13 = 0xe0000106
 LogonId     = {0x0 0x0}
 References  = 0
14 sessions in the system.

```

--------------------------------

### lm m s* command example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/lm--list-loaded-modules-

Shows the output of the 'lm' command with the 'm' and 's*' options, displaying only modules that begin with 's'. The output includes the start and end addresses, module names, and symbol status. Unloaded modules are listed separately.

```dbgcmd
kd> lm m s*
start    end        module name
f9f73000 f9f7fd80   sysaudio     (deferred)                 
fa04b000 fa09b400   srv          (deferred)                 
faab7000 faac8500   sr           (deferred)                 
facac000 facbae00   serial       (deferred)                 
fb008000 fb00ba80   serenum      e:\mysymbols\SereEnum.pdb\.......
fb24f000 fb250000   swenum       (deferred)                 

Unloaded modules:
f9f53000 f9f61000   swmidi.sys
fb0ae000 fb0b0000   splitter.sys
fb040000 fb043000   Sfloppy.SYS

```

--------------------------------

### Display current logging status with !logo

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-logexts-logo

Example output when !logexts.logo is used without parameters. Shows logging status, output directory, and settings for debugger, text file, and verbose log. The output directory is relative to the debugger start directory.

```dbgcmd
0:000> !logo
Logging currently enabled.

Output directory: MyLogs\LogExts\

Output settings:
  Debugger            Disabled
  Text file           Enabled
  Verbose log         Enabled

```

--------------------------------

### Search for ASCII string "B7" with s -a

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/s--search-memory-

Example of using the s command with the -a flag to search for the ASCII string "B7" in the memory range starting at @rsp with length L10000000. The output shows the addresses and hex dump of matches.

```dbgcmd
0:000> s -a @rsp L10000000 "B7"  
0000003f`ff07ef0a  42 37 ff 7f 00 00 90 38-4e c2 6c 01 00 00 7d 26  B7.....8N.l...}&
0000003f`ff0ff322  42 37 ff 7f 00 00 f8 5d-42 37 ff 7f 00 00 20 41  B7.....]B7.... A
0000003f`ff0ff32a  42 37 ff 7f 00 00 20 41-42 37 ff 7f 00 00 98 59  B7.... AB7.....Y

```

--------------------------------

### TTD.exe launch Notepad example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util

Launches and records Notepad. The trace stops when Notepad is closed.

```text
TTD.exe notepad.exe
```

--------------------------------

### Example output of !rpcexts.rpctime

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-rpcexts-rpctime

An example of the output generated when running the command in a user-mode debugger.

```dbgcmd
0:001> !rpcexts.rpctime
Current time is: 059931.126  (0x00ea1b.07e)
```

--------------------------------

### Example default prefix output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wmitrace-setprefix

Example of the prefix produced by the default trace message prefix format.

```dbgcmd
[CPUNumber]ProcessID.ThreadID::SystemTime [ProviderDirectory] 

```

--------------------------------

### Select TimeStart and lpFileName for matching CreateFileW calls

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-javascript-automation

Adds a .Select statement to print TimeStart and the lpFileName parameter for calls that match the string comparison. The output shows the TimeStart and the full file path.

```dbgcmd
dx -r2 @$cursession.TTD.Calls("kernelbase!CreateFileW").Where(x => x.Parameters.lpFileName.ToDisplayString("su").Contains("OLE")).Select(x => new { TimeStart = x.TimeStart, lpFileName = x.Parameters.lpFileName })

```

```dbgcmd
    [0x0]
        TimeStart        : 6E37:590
        lpFileName       : 0x346a78be90 : "C:\WINDOWS\SYSTEM32\OLEACCRC.DLL" [Type: wchar_t *]

```

--------------------------------

### !ndiskd.nwadapter command syntax

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-nwadapter

Displays information about nwifi!ADAPT structures. Without -handle, lists all structures; with -handle, shows details for the specified ADAPT block.

```console
!ndiskd.nwadapter [-handle <x>]

```

--------------------------------

### !usbkd.usbdstatus example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbdstatus

Example output of the !usbkd.usbdstatus command with status code 0xC0000008, which displays USBD_STATUS_DATA_OVERRUN.

```dbgcmd
1: kd> !usbkd.usbdstatus 0xC0000008

USBD_STATUS_DATA_OVERRUN (0xC0000008)

```
Tokens:
Raw