WinDbg

http://www.windbg.org
Admin
WinDbg is a powerful debugger for Windows that enables developers to analyze crash dumps, debug...
Tokens:509
Snippets:4
Trust Score:4.2
Update:7 months ago
Show doc for...
Tokens:
Raw
### Generate x64 System Stack Traces with WinDbg Script

Source: http://www.windbg.org

This WinDbg script iterates through all threads in an x64 system process to capture and display their complete stack traces. It uses `.for_each_thread` to loop through threads and `.thread` to switch context, followed by `kv` to display the stack.

```windbg
!for_each_thread "!thread @#Thread 16;.thread /w @#Thread; .reload; kv 256; .effmach AMD64"
```

--------------------------------

### Generate WOW64 x86 Stack Traces with WinDbg Script

Source: http://www.windbg.org

This WinDbg script is designed to capture x86 stack traces from WOW64 processes. It iterates through threads, checks if the process is WOW64, and then displays the stack trace if conditions are met.

```windbg
!for_each_thread ".thread @#Thread; r $t0 = @#Thread; .if (@@c++(((nt!_KTHREAD *)@$t0)->Process) == _ProcessAddress_) {.thread /w @#Thread; .reload; kv 256; .effmach AMD64 }"
```

--------------------------------

### Configure Symbol Path in WinDbg

Source: http://www.windbg.org

These commands configure the symbol path for WinDbg, which is essential for resolving symbols during debugging. The `.symfix` command sets a default symbol path, while `.sympath+` adds additional locations.

```windbg
srv*c:\mss*https://msdl.microsoft.com/download/symbols
.symfix c:\mss  
.sympath+ _other_symbols_location_
```

--------------------------------

### Identify Top CPU Consuming Threads with WinDbg Script

Source: http://www.windbg.org

This WinDbg script identifies threads that are consuming significant CPU resources by comparing their kernel and user time against a tick count. It uses `.for_each_thread` to examine each thread and conditional logic to flag high-CPU threads.

```windbg
!for_each_thread "r $t1 = dwo( @#Thread + @@c++(#FIELD_OFFSET(nt!_KTHREAD, KernelTime)) ); r $t0 = _Ticks_; .if (@$t1 > @$t0) {!thread @#Thread 3f}"  
!for_each_thread "r $t1 = dwo( @#Thread + @@c++(#FIELD_OFFSET(nt!_KTHREAD, UserTime)) ); r $t0 = _Ticks_; .if (@$t1 > @$t0) {!thread @#Thread 3f}"
```
Tokens:
Raw