### Tracelog command to start a trace session with -kd and -lowcapacity

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wmitrace-dynamicprint

Example Tracelog command to start a trace session with the -kd parameter (to send messages to the debugger) and -lowcapacity (to use a single buffer, ensuring events are displayed in order).

```text
Tracelog MySession -kd -lowcapacity

```

--------------------------------

### Example: Get endpoint data address using !usb2tree, !usbhcdext, !usblist, and !_ehciep

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd--ehciep

This example shows the full workflow to obtain and display a usbehci!_ENDPOINT_DATA structure. Start with !usb2tree to get the device extension address, then use !usbhcdext to find the GlobalEndpointList, use !usblist to list endpoints and identify the _ENDPOINT_DATA address, and finally pass that address to !_ehciep.

```dbgcmd
0: kd> !usbkd.usb2tree
...
2)!ehci_info ffffe0000206e1a0 !devobj ffffe0000206e050 PCI: VendorId 8086 DeviceId 293c RevisionId 0002 
    RootHub !hub2_info ffffe000024a61a0 !devstack ffffe000024a6050
        Port 1: !port2_info ffffe000026dd000 
        Port 2: !port2_info ffffe000026ddb40 
        Port 3: !port2_info ffffe000026de680 !devstack ffffe00001ec3060
            !device2_info ffffe00001ec31b0 (USB Mass Storage Device: Xxx Corporation)
        Port 4: !port2_info ffffe000026df1c0 

```

```dbgcmd
0: kd> !usbkd.usbhcdext ffffe0000206e1a0
...
DeviceHandleList: !usblist ffffe0000206f3b8, DL 
DeviceHandleDeletedList: !usblist ffffe0000206f3c8, DL [Empty]
GlobalEndpointList: !usblist ffffe0000206f388, EP 
...

```

```dbgcmd
0: kd> !usblist ffffe0000206f388, EP 
list: ffffe0000206f388 EP
...
dt usbport!_HCD_ENDPOINT ffffe000026dc970  !usbep ffffe000026dc970
common buffer bytes 0x00003000 (12288) @ va 0000000021e6e000 pa 00000000d83c9000
Device Address: 0x01, ep 0x81 Bulk In Flags: 00000041 dt _USB_ENDPOINT_FLAGS ffffe000026dc990
... usbehci!_ENDPOINT_DATA ffffe000026dcc38
...

```

```dbgcmd
0: kd> !usbkd._ehciep ffffe000026dcc38
*USBEHCI
dt usbehci!_ENDPOINT_DATA ffffe000026dcc38
Flags: 0x00000000
dt usbehci!_HCD_QUEUEHEAD_DESCRIPTOR ffffd00021e6e080
*HwQH ffffd00021e6e080
HwQH
     HwQH.HLink dea2e002
     HwQH.EpChars 02002101
         DeviceAddress: 0x1
         IBit: 0x0
         EndpointNumber: 0x1
         EndpointSpeed: 0x2 HcEPCHAR_HighSpeed
         DataToggleControl: 0x0
         HeadOfReclimationList: 0x0
         MaximumPacketLength: 0x200 - 512
   ...
current slot 0000000000000000
slot[0] dt usbehci!_ENDPOINT_SLOT ffffe000026dcdb8 - slot_NotBusy
----
     ffffd00021e6e100
     dt usbehci!_HCD_TRANSFER_DESCRIPTOR ffffd00021e6e100
    tdphys: d83c9100'200 txlen 00000000 tx ffffd00000000041 flags 6d4e695d  _BUSY _SLOT_RESET
    Next_qTD: d83c9200'd83c9180 AltNext_qTD 77423c00'41 
    NextTD: ffffd00021e6e200 AltNextTD ffffd00021e6e180 SlotNextTd ffffd00021e6e200 tok 00000c00  Xbytes x0 (0)
.
     ffffd00021e6e200
     dt usbehci!_HCD_TRANSFER_DESCRIPTOR ffffd00021e6e200
    tdphys: d83c9200'5000 txlen 00000000 tx ffffd00000000041 flags 6d4e695d  _BUSY _SLOT_RESET
    Next_qTD: d83c9280'd83c9180 AltNext_qTD 77423c00'41 
    NextTD: ffffd00021e6e280 AltNextTD ffffd00021e6e180 SlotNextTd ffffd00021e6e280 tok 00000c00  Xbytes x0 (0)
...

```

--------------------------------

### !storagekd.storhelp example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-storagekd-storhelp

Example output from the !storagekd.storhelp command, listing available Storage Debugger Extension commands.

```dbgcmd
# Storage Debugger Extension
===============================================
## General Commands
----------------
!storhelp    - Displays complete help of the commands provided in this KD extension
!storclass   - Dumps all class devices managed by classpnp
!storadapter - Dumps all adapters managed by Storport
!storunit    - Dumps all disks managed by Storport

## STORPORT specific commands
--------------------------
!storlogirp <args>     - displays internal log entries that reference the specified IRP.
                         See '!storhelp storlogirp' for details.
!storloglist <args>    - displays internal log entries. See '!storhelp storloglist' for details.
!storlogsrb <args>     - displays internal log entries that reference the specified SRB.
                         See '!storhelp storlogsrb' for details.
!storsrb <address>     - display details for the specified SCSI or STORAGE request block
```

--------------------------------

### !ndiskd.ndis output example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-ndis

Example output showing a Checked Ndis build on the debugee machine.

```console
0: kd> !ndiskd.ndis
Checked Ndis

```

--------------------------------

### !storagekd.storclass output example (no arguments)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-storagekd-storclass

Example output when !storagekd.storclass is run without arguments, showing a list of classpnp extensions. The output includes usage instructions for the command.

```dbgcmd
Storage class devices:

* !storclass fffffa80043dc060 [1,2] ST3160812AS Paging Disk       
  !storclass fffffa8006581740 [1,2] Msft Virtual Disk Disk       

Usage: !storclass <class device> <level [0-2]>

```

--------------------------------

### !scsikd.classext example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-scsikd-classext

Example output from the !scsikd.classext extension when no device is specified. It lists all class PnP extensions with device information and ends with a usage line.

```dbgcmd
0: kd> !scsikd.classext
  ' !scsikd.classext 8633e3f0 '   (             ) "IBM     " / "DDYS-T09170M    " / "S93E" / "        XBY45906"
  ' !scsikd.classext 86347b48 '   (paging device) "IBM     " / "DDYS-T09170M    " / "S80D" / "        VDA60491"
  ' !scsikd.classext 86347360 '   (             ) "UNISYS  " / "003451ST34573WC " / "5786" / "HN0220750000181300L6"
  ' !scsikd.classext 861d1898 '   (             ) "" / "MATSHITA CD-ROM CR-177" / "7T03" / ""

 usage: !classext <class fdo> <level [0-2]> 

```

--------------------------------

### !usbkd.usbver example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbver

Example output of the !usbkd.usbver command, showing the USBD interface version and the USB stack version.

```dbgcmd
1: kd> !usbkd.usbver

USBD VER 600 USB stack is VISTA

```

--------------------------------

### .netuse example connecting to a share

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-netuse--control-network-connections-

Example usage of .netuse to connect drive m: to \\myserver\myshare with empty user and password parameters.

```dbgcmd
0:000> .netuse "m:" "\\myserver\myshare" "" "" 

```

--------------------------------

### !storagekd.storadapter example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-storagekd-storadapter

Example of the !storagekd.storadapter display output.

```dbgcmd
# STORPORT adapters:

```

--------------------------------

### !ndiskd.compartments output example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-compartments

Example output from running !ndiskd.compartments, showing a single primary compartment with its ID, loopback network, loopback interface, and networks list.

```console
3: kd> !ndiskd.compartments
    Compartment        ffffdf80139b9940
    ID                 1
    Loopback Network   ffffdf80139b8900
    Loopback Interface ffffdf80139b6a20
    Networks:
                       ffffdf80139b8900    [Unnamed network]

```

--------------------------------

### Example: !usbkd.usb2tree output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbtt

Example output from the !usbkd.usb2tree command, showing the address of the device extension of the FDO as the argument of the DML command !ehci_info ffffe00001ca11a0.

```dbgcmd
0: kd> !usbkd.usb2tree
...
2)!ehci_info ffffe00001ca11a0 !devobj ffffe00001ca1050 PCI: VendorId 8086 DeviceId 293c RevisionId 0002 
...

```

--------------------------------

### !usbkd.usb2 command example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usb2

Example output from the !usbkd.usb2 command, showing USB endpoint scheduling information. The device extension address is passed as the argument.

```dbgcmd
0: kd> !usbkd.usb2 ffffe00001ca11a0

Sig: HFDO
Hcd FDO Extension:
----------
----------
dt usbport!_HCD_ENDPOINT ffffe0000212d970  !usbep ffffe0000212d970
    Tt 0000000000000000 Device Address: 0x00, ep 0x81 Interrupt In
    dt _USB2LIB_ENDPOINT_CONTEXT ffffe000023b60f0    dt _USB2_EP ffffe000023b6100
    Period,offset,Ordinal(32,0,0)   smask,cmask(00,00  ........ , ........) maxpkt 1

```

--------------------------------

### Example: Use !usblist with address and list type

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usblist

Final step in the example: pass the address of the linked list to !usblist with the DL list type. The output shows the list of device handles.

```dbgcmd
0: kd> !usblist ffffe00001ca23b8, DL
list: ffffe00001ca23b8 DL
----------
!usbdevh ffffe000020f9590
SSP [IdleReady] (0)
PCI\VEN_Xxxx  Xxxx Corporation
Root Hub
DriverName :  
----------
!usbdevh ffffe00001bce250
SSP [IdleReady] (0)
USB\Xxxx  Xxxx Corporation
Speed: HIGH, Address:  1, PortPathDepth: 1, PortPath: [3 0 0 0 0 0]
DriverName :\Driver\USBSTOR      !devstack ffffe000053ef2a0
----------

```

--------------------------------

### !pocaps example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-pocaps

Example output from the !pocaps command, showing the PopCapabilities structure with supported features and wake capabilities.

```dbgcmd
kd> !pocaps
PopCapabilities @ 0x8016b100
  Misc Supported Features:  S4 FullWake
  Processor Features:      
  Disk Features:            SpinDown
  Battery Features:        
  Wake Caps
    Ac OnLine Wake:         Sx
    Soft Lid Wake:          Sx
    RTC Wake:               Sx
    Min Device Wake:        Sx
    Default Wake:           Sx
```

--------------------------------

### !rpcexts.getclientcallinfo example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-rpcexts-getclientcallinfo

Example command and its output when run in a debugger, showing the search for call info and the resulting table of client call information.

```dbgcmd
0:002> !rpcexts.getclientcallinfo
Searching for call info ...
## PID  CELL ID   PNO  IFSTART  TIDNUMBER CALLID   LASTTIME PS CLTNUMBER ENDPOINT
------------------------------------------------------------------------------
03d4 0000.0001 0000 19bb5061 0000.0000 00000001 0004ca9b 07 0000.0002 1118

```

--------------------------------

### !ndiskd.netqueue example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-netqueue

Example output from !ndiskd.netqueue ffffd1022f512700, showing the NETTXQUEUE object, its ring buffer handle, and function pointers for its registered callbacks (EvtQueueAdvance, EvtQueueArmNotification, EvtQueueCancel).

```console
0: kd> !ndiskd.netqueue ffffd1022f512700

    NETTXQUEUE         00002efdd0aed9a8
    Ring buffer        ffffd1022d000000

    Switch to EC thread

    Event Callbacks                        Function pointer   Symbol (if available)
    EvtQueueAdvance                        fffff80034152af8   RtEthSample+2af8
    EvtQueueArmNotification                fffff80034159a94   RtEthSample+9a94
    EvtQueueCancel                         fffff800341598d8   RtEthSample+98d8
```

--------------------------------

### pt command with kb command example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/pt--step-to-next-return-

Example usage of the pt command with the kb command to display the stack trace after stepping to the next return instruction.

```dbgcmd
0:000> pt "kb"

```

--------------------------------

### !usbkd.usbchain example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbchain

Example output from the !usbkd.usbchain command when passed the PDO address ffffe00007c882a0. It shows the USB device chain from the specified PDO back to the root hub.

```dbgcmd
0: kd> !usbkd.usbchain ffffe00007c882a0

usbchain
*****************************************************************************
HUB PDO ffffe00007c882a0 on port 3 !usbhubext ffffe00007c883f0 ArmedForWake = 0
VID Xxxx PID Xxxx REV 0100  Xxxx Corporation
    HUB #3 FDO ffffe00002320050 , !usbhubext ffffe000023201a0  HWC_ARM=0
    ROOT HUB PDO(ext) @ffffe0000213c1a0
        ROOT HUB FDO @ffffe00001ca1050, !usbhcdext ffffe00001ca11a0 PCI Vendor:Device:...

```

--------------------------------

### Example output of !usbkd.isthisdumpasyncissue

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-isthisdumpasyncissue

Example output showing the command run after !analyze -v. The output indicates that the crash is NOT an Async on Advance Issue because the EndPointData is NULL.

```dbgcmd
1: kd> !analyze -v
*** ...
BUGCODE_USB_DRIVER (fe) 
...
1: kd> !usbkd.isthisdumpasyncissue
This is *NOT* Async on Advance Issue because the EndPointData is NULL

```

--------------------------------

### !usbkd.usbhubinfo example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbhubinfo

Example output from the !usbkd.usbhubinfo command when passed the FDO address ffffe00002320050. Displays hub properties such as number of ports, power capabilities, and wake states.

```dbgcmd
0: kd> !usbkd.usbhubinfo ffffe00002320050

    !DevObj ffffe00002320050 !usbhubext ffffe000023201a0 
On Host Controller (0x8086, 0x293c) 
        Stat_AsyncResumeStartAt: 2437ee39d29bd528
        Stat_AsyncResumeCompleteAt: 24413c77d29bd528
        Stat_AsyncResume: 0x3c(60) ms
        Stat_SyncResumeStartAt: 2437ee39d29bd528
        Stat_SyncResumeCompleteAt: 2437ee39d29bd528
        Stat_SyncResume: 0x0(0) ms
Trap Regs: Event, Port, Event (ffffe000023204d0) 
    Enable: 0 Port: 0 Event 00000000
Hub Number: # 3
Number Of Ports: 4
dt usbhub!_USBHUB_FDO_FLAGS ffffe00002320ba0
>Is Root
>Power Switching: 
     No Power Switching 
>Overcurrent: 
     Global Overcurrent 
>PortIndicators: 
     No PortIndicators present
>AllowWakeOnConnect: 
     DO NOT WakeOnConnect
>CURRENT Hub Wake on Connectstate: 
     HWC_DISARM:- do not wake system on connect/disconnect event
>CURRENT Bus Wake state: 
     BUS_DISARM:- bus not armed for wake by this hub
>CURRENT Wake Detect state (WW Irp): 
     HUB_DISARM:- no ww irp pending (HUB_WAKESTATE_DISARMED)
Milliamps/Port : 500ma
Power caps (0 = not reported)
     PortPower_Registry : 0
     PortPower_DeviceStatus : 500
     PortPower_CfgDescriptor : 500
     PortPower_HubStatus : 500

```

--------------------------------

### Example output of !usbkd.usbpdos

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbpdos

Example output from the !usbkd.usbpdos command, showing two USB PDOs with their device descriptors, vendor information, hub FDO and port, power states, and timing statistics.

```dbgcmd
0: kd> !usbkd.usbpdos

ext ffffe00006c513f0
VID 0a12 PID 0001 REV 0309 
 dt USBHUB!_USB_DEVICE_DESCRIPTOR ffffe00006c51960
Vendor: Xxxx
 Xxxx Corporation
 dd Class: (224)(e0)
 (224)(e0)
HubFdo: ffffe00000d94050, port: 2
<null>
SystemWake 5 SystemHibernate(S4)
wake_irp_list_head = ffffe00006c51cb0
wake_irp = ffffe00006c51cb0
PDO Times:
    Stat_PdoCreatedAt: 0d29bbd58
    Stat_PdoEnumeratedAt: b65ace75d29bbd58
    Stat: Enumeration Time: 0xa7d3842a(-1479310294) ms
    Stat_Pdo_SetD0_StartAt: 0d29bbd58
    Stat_Pdo_SetD0_CompleteAt: 0d29bbd58
    Stat: PDO Set_D0 time: 0x0(0) ms

## 

ext ffffe00007c883f0
VID 0781 PID 5530 REV 0100 
 dt USBHUB!_USB_DEVICE_DESCRIPTOR ffffe00007c88960
Vendor: Xxxx
 Xxxx Corporation
 dd Class: (0)(0)
 (8)Class_UsbStorage
HubFdo: ffffe00002320050, port: 3
:Xxxx  
SystemWake 5 SystemHibernate(S4)
wake_irp_list_head = ffffe00007c88cb0
wake_irp = ffffe00007c88cb0
PDO Times:
    Stat_PdoCreatedAt: 0d29bbd58
    Stat_PdoEnumeratedAt: 2380af52d29bbd58
    Stat: Enumeration Time: 0x9a24226c(-1708907924) ms
    Stat_Pdo_SetD0_StartAt: 0d29bbd58
    Stat_Pdo_SetD0_CompleteAt: 0d29bbd58
##     Stat: PDO Set_D0 time: 0x0(0) ms

```

--------------------------------

### Example output of !usbkd.usbhcdlist

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbhcdlist

Example output from the !usbkd.usbhcdlist command, showing the miniport list and sections for UHCI and EHCI controllers with details such as device objects, operational registers, and pending IRPs.

```dbgcmd
0: kd> !usbkd.usbhcdlist
MINIPORT List @ fffff80001e5bbd0

## List of UHCI controllers

!drvobj ffffe00002000060 dt USBPORT!_USBPORT_MINIPORT_DRIVER ffffe00001f48010 Registration Packet ffffe00001f48048

01
...

## List of EHCI controllers

!drvobj ffffe00001fd33a0 dt USBPORT!_USBPORT_MINIPORT_DRIVER ffffe00001f48bd0 Registration Packet ffffe00001f48c08

01. Xxxxx Corporation PCI: VendorID Xxxx DeviceID Xxxx RevisionId 0002
    !devobj ffffe00001ca1050
    !ehci_info ffffe00001ca11a0
    Operational Registers ffffd000228bf020
    Device Data ffffe00001ca2da0
    !usbhcdlog ffffe00001ca11a0
    nt!_KINTERRUPT ffffe000020abe78
    Device Capabilities ffffe00001ca135c
    Pending IRP's: 0, Transfers: 0 (Periodic(0), Async(0))

```

--------------------------------

### IRQL transition log example (64-bit Windows)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-verifier

Shows two consecutive entries from the IRQL transition log for Processor 2, illustrating that the log is not always complete on 64-bit Windows. The first entry shows IRQL going from 2 to 0, the second from 2 to 2, with missing information on how the IRQL was raised from 0 to 2.

```dbgcmd
Thread:             fffffa80068c9400
Old irql:           0000000000000002
New irql:           0000000000000000
Processor:          0000000000000002
Time stamp:         0000000000000857

    fffff8800140f12a ndis!ndisNsiGetInterfaceInformation+0x20a
    fffff88001509478 NETIO!NsiGetParameterEx+0x178
    fffff88005f062f2 nsiproxy!NsippGetParameter+0x24a
    fffff88005f086db nsiproxy!NsippDispatchDeviceControl+0xa3
    fffff88005f087a0 nsiproxy!NsippDispatch+0x48

Thread:             fffffa80068c9400
Old irql:           0000000000000002
New irql:           0000000000000002
Processor:          0000000000000002
Time stamp:         0000000000000857

    fffff8800140d48d ndis!ndisReferenceTopMiniportByNameForNsi+0x1ce
    fffff8800140f072 ndis!ndisNsiGetInterfaceInformation+0x152
    fffff88001509478 NETIO!NsiGetParameterEx+0x178
    fffff88005f062f2 nsiproxy!NsippGetParameter+0x24a
    fffff88005f086db nsiproxy!NsippDispatchDeviceControl+0xa3

```

--------------------------------

### !ndiskd.pktpools example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-pktpools

Example output from running !ndiskd.pktpools on a system with no legacy NDIS 5.x drivers installed. The packet pool handles are not clickable because NDIS does not use packet pools starting with NDIS 6.0.

```console
3: kd> !ndiskd.pktpools
Pool      Allocator  BlocksAllocated  BlockSize  PktsPerBlock  PacketLength
ffffdf80131d58c0  fffff80f1fbe3e8f   0x1          0x1000     0xa           0x190   ndis!DriverEntry+6af
ffffdf80131d5940  fffff80f1fbe3e71   0x1          0x1000     0xa           0x180   ndis!DriverEntry+691

```

--------------------------------

### List all open bindings with !ndiskd.mopen

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-mopen

Example output from running !ndiskd.mopen with no parameters, showing a list of all open bindings between miniports and protocols. The example highlights the binding between Microsoft ISATAP Adapter #2 and TCPIP6TUNNEL with handle ffff8083e56b8110.

```console
3: kd> !ndiskd.mopen
Open ffff8083e56b8110
  Miniport: ffff8083e02ce1a0 - Microsoft ISATAP Adapter #2
  Protocol: ffff8083e1a95c00 - TCPIP6TUNNEL

Open ffff8083e11902c0
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e3e8f6b0 - RSPNDR

Open ffff8083e55f3010
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e0114730 - NDISUIO

Open ffff8083e15537d0
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e3e90800 - LLTDIO

Open ffff8083e3926010
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e3e90c10 - MSLLDP

Open ffff8083e0c565a0
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e11cec10 - TCPIP

Open ffff8083e504c770
  Miniport: ffff8083e0f501a0 - Microsoft Kernel Debug Network Adapter
  Protocol: ffff8083e19bfc10 - TCPIP6

```

--------------------------------

### Example: Get FDO address with !usb2tree

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-ehci-info-from-fdo

Example output from the !usb2tree command, used to obtain the address of the FDO of the USB host controller. In this example, the FDO address is ffffe00001ca1050.

```dbgcmd
0: kd> !usbkd.usb2tree

EHCI MINIPORT(s) dt usbport!_USBPORT_MINIPORT_DRIVER ffffe00001f48bd0

1)!ehci_info ffffe00001ca11a0 !devobj ffffe00001ca1050 PCI: VendorId 8086 DeviceId 293c RevisionId 0002 
...

```

--------------------------------

### Illustrate /0, /1, and /2 options

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/x--examine-symbols-

Shows the output of the x command with the /0, /1, and /2 options for the pattern 'MyApp!Add*'. /0 displays only addresses, /1 displays only symbol names, and /2 displays both addresses and names. These options are useful for piping output to the .foreach command.

```dbgcmd
0:000:x86> x /0 MyApp!Add*
00b51410          
00b513d0 
      
0:000:x86> x /1 MyApp!Add*
MyApp!AddThreeIntegers
MyApp!AddTwoIntegers

0:000:x86> x /2 MyApp!Add*
00b51410          MyApp!AddThreeIntegers
00b513d0          MyApp!AddTwoIntegers

```

--------------------------------

### g- command to reach start of trace

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-replay

Use the g- command to execute backwards until an event or the beginning of the TTD trace is reached. In this example, the start of the trace is reached, and the output shows the 'TTD: Start of trace reached.' message.

```dbgcmd
0:000> g-
TTD: Start of trace reached.
(3f78.4274): Break instruction exception - code 80000003 (first/second chance not available)
Time Travel Position: 29:0
ntdll!ZwTestAlert+0x14:
00007ffc`61f789d4 c3              ret

```

--------------------------------

### Launch and record a Windows app with a passed parameter (default mode)

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util

Starts ping with a parameter, omitting the -launch option because it is the default mode. The trace file is named ping01.run.

```console
C:\TTD> TTD.exe ping.exe msn.com
Launching 'ping.exe msn.com'
    Recording process (PID:24044) on trace file: C:\TTD\ping01.run

Pinging msn.com [204.79.197.219] with 32 bytes of data:
Reply from 204.79.197.219: bytes=32 time=22ms TTL=118
Reply from 204.79.197.219: bytes=32 time=21ms TTL=118
Reply from 204.79.197.219: bytes=32 time=25ms TTL=118
Reply from 204.79.197.219: bytes=32 time=21ms TTL=118

Ping statistics for 204.79.197.219:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 21ms, Maximum = 25ms, Average = 22ms
ping.exe(x64) (PID:24044): Process exited with exit code 0 after 3390ms
  Full trace dumped to C:\TTD\ping01.run

```

--------------------------------

### Example: Get transfer context address using !_ehciep

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd--ehcitd

Example output from the !_ehciep command showing how to obtain the address of a usbehci!_TRANSFER_CONTEXT structure. The address ffffd00021e65100 is passed to !_ehcitd.

```dbgcmd
0: kd> !_ehciep ffffe000001ab618
*USBEHCI
dt usbehci!_ENDPOINT_DATA ffffe000001ab618
Flags: 0x00000000
dt usbehci!_HCD_QUEUEHEAD_DESCRIPTOR ffffd00021e65080
*HwQH ffffd00021e65080
HwQH
     HwQH.HLink dea2e002
     HwQH.EpChars 02002201
         DeviceAddress: 0x1
         IBit: 0x0
         EndpointNumber: 0x2
    ...
slot[0] dt usbehci!_ENDPOINT_SLOT ffffe000001ab798 - slot_NotBusy
----
     ffffd00021e65100
     dt usbehci!_HCD_TRANSFER_DESCRIPTOR ffffd00021e65100
    ....

```

--------------------------------

### Get EHCI controller operational registers address with !usbkd.usbhcdlist

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd--ehciregs

Example output from !usbkd.usbhcdlist showing how to find the address of a usbehci!_HC_OPERATIONAL_REGISTER structure. The address ffffd000228bf020 is used in the next example.

```dbgcmd
0: kd> !usbkd.usbhcdlist
MINIPORT List @ fffff80001e5bbd0

## List of EHCI controllers

!drvobj ffffe00001fd33a0 dt USBPORT!_USBPORT_MINIPORT_DRIVER ...
...
02. Xxxx Corporation PCI: VendorID Xxxx DeviceID Xxxx RevisionId 0002
    !devobj ffffe00001ca1050
    !ehci_info ffffe00001ca11a0
    Operational Registers ffffd000228bf020

```

--------------------------------

### !ndiskd.netring example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-netring

Example output from running !ndiskd.netring with a NET_RING handle. The output shows the ring's begin, next, and end indices, element stride, element index mask, number of elements, and ownership counts.

```console
0: kd> !ndiskd.netring ffff8b82f8e75000 

NET RING               ffff8b82f8e75000

Begin index            000
Next index             000
End index              0x2
Reserved by OS         000
Element stride         0x40
Element index mask     0x7f

Number of elements     0x80
Owned by OS            0x7e
Owned by Client        0x2

```

--------------------------------

### !ndiskd.nbl example - display NBL information

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-nbl

Example output from running !ndiskd.nbl with an NBL handle. Shows the NBL address, next NBL, first NET_BUFFER, source adapter, flags, and available actions such as walking the NBL chain, dumping data payload, showing out-of-band information, and reviewing NBL history.

```console
2: kd> !ndiskd.nbl ffffdf80149524a0
    NBL                ffffdf80149524a0    Next NBL           NULL
    First NB           ffffdf8014952610    Source             ffffdf80140c71a0 - Microsoft Kernel Debug Network Adapter
    Flags              INDICATED, RETURNED, NBL_ALLOCATED, PROTOCOL_020_0,
                       PROTOCOL_200_0

    Walk the NBL chain                     Dump data payload
    Show out-of-band information
    Review NBL history

```

--------------------------------

### Get device handle addresses using !usbkd.usblist

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbdevh

Example output from the !usbkd.usblist command, showing the addresses of usbport!_USBD_DEVICE_HANDLE structures.

```dbgcmd
0: kd> !usblist ffffe00001ca23b8, DL
list: ffffe00001ca23b8 DL
----------
!usbdevh ffffe000020f9590
SSP [IdleReady] (0)
...

```

--------------------------------

### List HCD_ENDPOINT structures with !usblist

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbep

Use !usblist with the GlobalEndpointList address to get addresses of _HCD_ENDPOINT structures. The output shows an example address ffffe000020f6970.

```dbgcmd
0: kd> !usblist ffffe00001ca2388, EP

list: ffffe00001ca2388 EP
----------
dt usbport!_HCD_ENDPOINT ffffe000020f6970  !usbep ffffe000020f6970
Device Address: 0x00, ep 0x00 Control  Flags: 00000002 dt _USB_ENDPOINT_FLAGS ffffe000020f6990
dt usbport!_ENDPOINT_PARAMETERS ffffe000020f6b18    RootHub Endpoint
...

```

--------------------------------

### Use x /0 output with .foreach

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/x--examine-symbols-

Shows how to use the output of the x command with the /0 option as input to the .foreach command. The example iterates over symbols matching 'MyApp!*MySym*' and echoes each address plus 0x18.

```dbgcmd
.foreach ( place { x /0 MyApp!*MySym*} ) { .echo ${place}+0x18 }

```

--------------------------------

### Get device handle list using !usbkd.usbhcdext

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbdevh

Example output from the !usbkd.usbhcdext command, showing the device handle list for a USB host controller.

```dbgcmd
0: kd> !usbkd.usbhcdext ffffe00001ca11a0

HC Flavor 1000  FDO ffffe00001ca1050
Root Hub: FDO ffffe00002320050 !hub2_info ffffe000023201a0
Operational Registers ffffd000228bf020
Device Data ffffe00001ca2da0
dt USBPORT!_FDO_EXTENSION ffffe00001ca15a0
DM Timer Flags ffffe00001ca16d4
FDO Flags ffffe00001ca16d0
HCD Log ffffe00001ca11a0

DeviceHandleList: !usblist ffffe00001ca23b8, DL 
DeviceHandleDeletedList: !usblist ffffe00001ca23c8, DL [Empty]
...

```

--------------------------------

### !ndiskd.nbl -data output showing NET_BUFFER handle

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-ndiskd-nb

Output from !ndiskd.nbl -data that shows the NET_BUFFER handle ffffdf8014952610. This is the starting point for the subsequent !ndiskd.nb examples.

```console
2: kd> !ndiskd.nbl ffffdf80149524a0 -data
NET_BUFFER ffffdf8014952610

```

--------------------------------

### !wsle example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wsle

Example output from an x86 target running Windows Server 2003. Shows the working set list header and WSLE details when flag 3 (0x1 and 0x2) is used.

```dbgcmd
kd> !wsle 3

Working Set @ c0503000
    FirstFree:       a7  FirstDynamic:          4
    LastEntry      23d  NextSlot:         4  LastInitialized      259
    NonDirect       65  HashTable:        0  HashTableSize:         0

Reading the WSLE data...

Virtual Address           Age  Locked  ReferenceCount
        c0300203          0        1        1
        c0301203          0        1        1
        c0502203          0        1        1
        c0503203          0        1        1
        c01ff201          0        0        1
        77f74d19          3        0        1
        7ffdfa01          2        0        1
        c0001201          0        0        1

.....

Reading the WSLE data...
Valid WSLE entries = 0xa7
found end @ wsle index 0x259

.....

```

--------------------------------

### Get transfer list with !usbkd.usbhcdext

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-usbkd-usbtx

Example output from !usbkd.usbhcdext showing the I/O transfer list. The address ffffe0000653401c is the address of an _HCD_TRANSFER_CONTEXT structure to pass to !usbtx.

```dbgcmd
0: kd> !usbkd.usbhcdext ffffe00001c8f1a0
...
## I/O TRANSFER LIST(s)

1.) Transfer Request Priority List: (TxQueued) Type: 0-NotSplit, 1-Parent, 2-Child
    --------------------------------------------------------------------------------
    [000]!usbtx ffffe0000653401c !usbep ffffe00004730c60 !irp ffffe00004221220 State: (7)TX_Mapped_inMp
        Priority: 0, Type: 0, Flags= 0000000a, SequenceNum: 10, SplitIdx: 0
        InLen: 4096, OutLen: 0 Status: USBD_STATUS_PENDING (0x40000000)
    ...

```

--------------------------------

### !minipkd.adapters example output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-minipkd-adapters

Example output of the !minipkd.adapters command. Shows two adapters and their associated LUNs with flags such as c (claimed), e (enumerated), v (visible), p (paging), and d (dump).

```dbgcmd
0: kd> !minipkd.adapters
Adapter \Driver\lp6nds35     DO 86334a70         DevExt 86334b28
Adapter \Driver\adpu160m     DO 8633da70         DevExt 8633db28
 LUN 862e60f8 @(0,0,0) c ev     pnp(00/ff) pow(0,0) DevObj 862e6040
 LUN 863530f8 @(0,1,0) c ev p d pnp(00/ff) pow(0,0) DevObj 86353040
 LUN 862e50f8 @(0,2,0) c ev     pnp(00/ff) pow(0,0) DevObj 862e5040
 LUN 863520f8 @(0,6,0)   ev     pnp(00/ff) pow(0,0) DevObj 86352040
Adapter \Driver\adpu160m     DO 86376040         DevExt 863760f8

```

--------------------------------

### Check valid memory range with $vvalid

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/masm-numbers-and-operators

Uses the $vvalid operator to check if a memory range is valid. The example checks a range starting at 0x00007ff60f620000 with length 0xFFFF, returning 1 (valid).

```dbgcmd
0:000> ? $vvalid(0x00007ff60f620000, 0xFFFF)
Evaluate expression: 1 = 00000000`00000001
```

--------------------------------

### Search for DWORD value 'H' with s -d

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/s--search-memory-

Example of using the s command with the -d flag to search for a DWORD value 'H' in the memory range starting at @rsp with length L1000000. The output shows the addresses and hex dump of matches.

```dbgcmd
0:000> s -d @rsp L1000000 'H'  
0000003f`ff07ec00  00000048 00000000 500c0163 00000000  H.......c..P....
0000003f`ff07ec50  00000048 00000000 00000080 00000000  H...............
0000003f`ff07efc0  00000048 00000000 400c0060 00000000  H.......`..@....

```

--------------------------------

### lm m s* command example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/lm--list-loaded-modules-

Shows the output of the 'lm' command with the 'm' and 's*' options, displaying only modules that begin with 's'. The output includes the start and end addresses, module names, and symbol status. Unloaded modules are listed separately.

```dbgcmd
kd> lm m s*
start    end        module name
f9f73000 f9f7fd80   sysaudio     (deferred)                 
fa04b000 fa09b400   srv          (deferred)                 
faab7000 faac8500   sr           (deferred)                 
facac000 facbae00   serial       (deferred)                 
fb008000 fb00ba80   serenum      e:\mysymbols\SereEnum.pdb\.......
fb24f000 fb250000   swenum       (deferred)                 

Unloaded modules:
f9f53000 f9f61000   swmidi.sys
fb0ae000 fb0b0000   splitter.sys
fb040000 fb043000   Sfloppy.SYS

```

--------------------------------

### Display current logging status with !logo

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-logexts-logo

Example output when !logexts.logo is used without parameters. Shows logging status, output directory, and settings for debugger, text file, and verbose log. The output directory is relative to the debugger start directory.

```dbgcmd
0:000> !logo
Logging currently enabled.

Output directory: MyLogs\LogExts\

Output settings:
  Debugger            Disabled
  Text file           Enabled
  Verbose log         Enabled

```

--------------------------------

### Example output of !rpcexts.rpctime

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-rpcexts-rpctime

An example of the output generated when running the command in a user-mode debugger.

```dbgcmd
0:001> !rpcexts.rpctime
Current time is: 059931.126  (0x00ea1b.07e)
```

--------------------------------

### TTD.exe launch Notepad example

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util

Launches and records Notepad. The trace stops when Notepad is closed.

```text
TTD.exe notepad.exe
```

--------------------------------

### Example default prefix output

Source: https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-wmitrace-setprefix

Example of the prefix produced by the default trace message prefix format.

```dbgcmd
[CPUNumber]ProcessID.ThreadID::SystemTime [ProviderDirectory] 

```