WinDbg

http://windbg.info/doc/
Admin
WinDbg is a powerful debugger for Windows that provides command-line debugging capabilities for...
Tokens:29,330
Snippets:263
Trust Score:4.8
Update:10 months ago
Show doc for...
Tokens:
Raw
### Logging Extension Example Configuration

An example sequence of commands to configure logging, including enabling specific categories, disabling all categories, and setting output preferences.

```windbg
!loge
!logc d *
!logc p 19
logc e 19 22
!logo d v
!logo d t
!logo e d

```

--------------------------------

### Example Logging Configuration in WinDbg

This snippet shows a practical example of configuring logging using logexts.dll commands. It demonstrates enabling specific logging categories, disabling others, and adjusting output verbosity for debugging purposes.

```WinDbg
!loge| Enable logging
```

```WinDbg
!logc d *
```

```WinDbg
!logc p 19
```

```WinDbg
logc e 19 22
```

```WinDbg
!logo d v
```

```WinDbg
!logo d t
```

```WinDbg
!logo e d
```

--------------------------------

### Heap Allocation Example in C

A C code example illustrating memory allocation using HeapAlloc. This is often the source for the [UserAddr] used in WinDbg heap analysis commands. It shows how to allocate a specified size of memory and obtain a pointer to it.

```C
int AllocSyze = 0x100000; // == 1 MB
BYTE* pUserAddr = (BYTE*) HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, AllocSyze);

```

--------------------------------

### Application Verifier Setup (gflags.exe)

Configures Application Verifier settings for a specific executable using gflags.exe. Enabling page heap features like +ust and +hpa is necessary for detailed heap analysis and source information.

```cmd
gflags.exe /i MyApp.exe +ust +hpa

```

--------------------------------

### Extension Help Commands

Commands to get help information for various WinDbg extensions.

```APIDOC
## Extension Help Commands

### Description
Commands to retrieve detailed help information for different categories of WinDbg extensions.

### Commands

#### `!Ext.help` / `!Exts.help`

- **Description**: General help for extensions.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!Uext.help`

- **Description**: Help for User-Mode Extensions (non-OS specific).
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!Ntsdexts.help`

- **Description**: Help for User-Mode Extensions (OS specific).
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!logexts.help`

- **Description**: Help for Logger Extensions.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!clr10\sos.help`

- **Description**: Help for debugging managed code (SOS extensions).
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!wow64exts.help`

- **Description**: Help for Wow64 debugger extensions.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!Wdfkd.help`

- **Description**: Help for Kernel-Mode driver framework extensions.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!Gdikdx.help`

- **Description**: Help for Graphics driver extensions.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A

#### `!NAME.help`

- **Description**: Displays detailed help about an exported function within an extension DLL.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A
- **Parameters**:
  - **Path Parameters**:
    - `NAME` (string) - Required - Placeholder for the extension DLL name (e.g., `Ntsdexts`).
    - `FUNCTION` (string) - Required - Placeholder for the exported function name (e.g., `handle`).

### Request Example

```
!Ntsdexts.help handle
```

### Response Example

*(Detailed help information for the specified extension function)*
```

--------------------------------

### Advanced Stepping Options in WinDbg

Details advanced options for stepping commands, including specifying a count of instructions/lines, executing debugger commands after a step, starting execution from a specific address, and controlling thread execution.

```windbg
p **Count**
p [Count] **"Command"**
p =StartAddress [Count] ["Command"]
[~Thread] p [=StartAddress] [Count] ["Command"]
```

--------------------------------

### Skipping Function Execution with Breakpoints

Provides examples of using breakpoints to skip the execution of a function by manipulating the instruction pointer (EIP) and stack pointer (ESP). This is achieved by setting EIP to the return address and adjusting ESP.

```windbg
bu sioctl!DriverEntry "r eip = poi(@esp); r esp = @esp + 0xC; .echo sioctl!DriverEntry skipped; g"
bu MyApp!WinMain "r eip = poi(@esp); r esp = @esp + 0x14; .echo WinSpy!WinMain entered; g"
```

--------------------------------

### Display Loaded Modules in WinDbg

This command lists all loaded modules in the debugged process. It can be used to find information about a specific module, such as its start and end addresses, and image path.

```WinDbg
lm vm 77fba431
```

--------------------------------

### Break Before Driver Load using nt!IopLoadDriver (WinDbg)

This advanced technique sets a conditional breakpoint on 'nt!IopLoadDriver' to break before a specific driver ('77fba431.sys' in this example) is loaded into memory. It uses WinDbg scripting to check the driver path and only breaks if the target driver is found, otherwise it continues execution.

```WinDbg
bu nt!IopLoadDriver ".block {as /c HandleOutput **!handle poi(@esp+4)**}; .block {.if ( $spat( \"${HandleOutput}\", \"* **77fba431** *\" ) ) { .echo ***** Loading our driver *****; ad *; } .else { ad *; g;}}";
```

--------------------------------

### Get Driver Base Address and Set Breakpoint (WinDbg)

This method shows how to retrieve the base address of a driver in memory using WinDbg commands like '!lmi' or 'lm vm'. It then explains how to set a breakpoint using the base address and the entry point's relative virtual address (RVA).

```WinDbg
!lmi 77fba431

```

```WinDbg
lm vm 77fba431

```

```WinDbg
bp BaseAddress + rva_entrypoint
```

--------------------------------

### Get Stack Trace from Allocated Memory in WinDbg

This snippet demonstrates how to retrieve the stack trace of memory allocation using WinDbg commands. It requires prior allocation of memory and obtaining its address. The output is a stack trace, which can be further analyzed for source information.

```WinDbg
!heap -p -a [UserAddr]
```

```WinDbg
dt ntdll!_DPH_HEAP_BLOCK StackTrace [MyHeapBlockAddr]
```

```WinDbg
dds [StackTrace]
```

--------------------------------

### Get Image Entry Point Address in WinDbg

This command evaluates an expression to get the Image Entry (DriverEntry) address for a given module base address. The result can then be used to set a breakpoint.

```WinDbg
? $iment( ba644000)
```

--------------------------------

### Setting Breakpoints in WinDbg

Demonstrates various ways to set breakpoints in WinDbg, including at source code lines, symbolic patterns, module load, write access, and specific methods. It also shows how to renumber breakpoints.

```windbg
bp `mod!source.c:12`
bm myprogram!mem*
bu myModule!func
ba w4 77a456a8
bp @@( MyClass::MyMethod )
br | br OldID NewID [OldID2 NewID2 ...]
```

--------------------------------

### Setting Breakpoints by Source Code and Symbols

Demonstrates setting breakpoints directly using source code file and line numbers, symbolic patterns, or module and function names. These methods are useful for debugging at a higher level of abstraction.

```windbg
bp `mod!source.c:12`
bm myprogram!mem*
bu myModule!func
```

--------------------------------

### Setting Breakpoints with Options (Count and Access Type)

Shows how to configure breakpoints with additional options. This includes setting breakpoints that trigger only once, after a specific number of passes, or on memory access events like write.

```windbg
bp mod!addr /1
bp mod!addr k
ba w4 77a456a8
```

--------------------------------

### Get Stack Trace in WinDbg

This command displays the call stack of the current thread. It's useful for understanding the execution flow leading to the current state and for identifying function calls.

```WinDbg
kb
```

--------------------------------

### Setting Breakpoints with Commands

Illustrates setting breakpoints that execute debugger commands when hit. This is useful for logging, creating dumps, or conditional execution based on function arguments or other runtime conditions.

```windbg
ba w4 81a578a8 "k;g"
bu myModule!func ".dump c:\dump.dmp; g"
bu MYDLL!DllMain "j (dwo(@esp+8) == 1) '.echo MYDLL!DllMain -> DLL_PROCESS_ATTACH; kn' ; 'g' "
bu kernel32!LoadLibraryExW ".echo LoadLibraryExW for ->; du dwo(@esp+4); g"
bu kernel32!LoadLibraryExW ";as /mu ${/v:MyAlias} poi(@esp+4); .if ( $spat( \"${MyAlias}\", \"*MYDLL*\" ) != 0 ) { kn; } .else { g }"
```

--------------------------------

### Thread Context Switching (~r, ~k, ~kd)

Commands for switching thread context and displaying stack information. '~<TID> r' switches to a thread, '~<TID> k' displays its stack, and '~<TID> kd' displays its stack in detail.

```debugger
~<TID>e r; k; kd
```

```debugger
== ~<TID>r; ~<TID>k; ~<TID>kd
```

--------------------------------

### Heap Allocation Address Retrieval (C++)

Demonstrates how to allocate memory using HeapAlloc in C++ and obtain a user address. This address can then be used for further heap analysis with WinDbg commands like !heap -p -a.

```cpp
int AllocSyze = 0x100000; 	// == 1 MB
BYTE* pUserAddr = (BYTE*) HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, AllocSyze);

```

--------------------------------

### Set Breakpoint on Driver Entry Point (WinDbg)

This snippet demonstrates how to set a breakpoint directly on a driver's entry point (DriverEntry) in WinDbg. This is the most straightforward method when the driver has symbols available.

```WinDbg
bp 77fba431!DriverEntry
```

--------------------------------

### WinDbg Tracing and Stepping Commands

Details commands for controlling code execution step-by-step. This includes single instruction execution ('p'), tracing into subroutines ('t'), and executing until the current function returns ('gu').

```windbg
g (F5)
gu
p (F10)
t (F11)
pt
pr
pc
```

--------------------------------

### Heap Inspection and Management (WinDbg)

Commands for examining and managing heaps. '!heap' provides various views including summary, detailed info, block searches, and leak detection. It also supports setting conditional breakpoints for heap operations.

```WinDbg
!heap -?
!heap
!heap -h [HeapAddr | Idx | 0]
!heap -v [HeapAddr | Idx | 0]
!heap -s [HeapAddr | 0]
!heap -i [HeapAddr]
!heap -x [-v] Address
!heap -l
!heap -b, -B | !heap Heap -b [alloc | realloc | free] [Tag]
!heap Heap -B [alloc | realloc | free]
!heap -flt | !heap -flt s Size
!heap -flt r SizeMin SizeMax
!heap -stat | !heap -stat
!heap -stat -h [HeapHandle | 0]
!heap -p | !heap -p -?
!heap -p
!heap -p -h HeapHandle
!heap -p -a UserAddr
!heap -p -all
```

--------------------------------

### Set Breakpoint on Driver Entrypoint (WinDbg)

This snippet addresses how to set a breakpoint on a driver's entry point when the driver name is provided as a hexadecimal value. It explains the challenge of WinDbg interpreting the hex value as an address and suggests a method to treat it as a module name.

```windbg
bp <hex_driver_name>+rva_entrypoint
```

--------------------------------

### Compare, Move, and Fill Memory in WinDbg

Commands to compare, move, and fill specified memory ranges. 'c' compares byte-for-byte, 'm' moves data, and 'f' fills memory with a given pattern. Ranges can be specified by address and length.

```WinDbg CLI
c Addr L100 DestAddr
m Addr L20 DestAddr
f Addr L20 'A' 'B' 'C'
f Addr L20 41 42 43
```

--------------------------------

### Application Verifier Commands in WinDbg

This section details various commands for the Application Verifier extension (!avrf) in WinDbg. These commands allow for the inspection and debugging of heap, handles, locks, threads, and more. They provide options to display general information, search logs by address, and inspect specific log types.

```WinDbg
!avrf
```

```WinDbg
!avrf -?
```

```WinDbg
!avrf -vs N
```

```WinDbg
!avrf -vs -a ADDR
```

```WinDbg
!avrf -hp N
```

```WinDbg
!avrf -hp -a ADDR
```

```WinDbg
!avrf -cs N
```

```WinDbg
!avrf -cs -a ADDR
```

```WinDbg
!avrf -dlls N
```

```WinDbg
!avrf -ex N
```

```WinDbg
!avrf -cnt
```

```WinDbg
!avrf -threads
```

```WinDbg
!avrf -trm
```

```WinDbg
!avrf -trace INDEX
```

```WinDbg
!avrf -brk [INDEX]
```

--------------------------------

### Compare, Move, Fill, and Search Memory (WinDbg)

Commands for directly manipulating memory contents. 'c' compares ranges, 'm' moves data, 'f' fills with a pattern, and 's' searches for patterns. Various pattern types (bytes, ASCII, Unicode) and search flags are supported.

```WinDbg
c Range DestAddr
m Range DestAddr
f Range Pattern
s Range Pattern
s -[Flags]b Range Pattern
s -[Flags]w Range 'Pattern'
s -[Flags]d Range 'Pattern'
s -[Flags]q Range 'Pattern'
s -[Flags]a Range "Pattern"
s -[Flags]u Range "Pattern"
s -[Flags,l length]sa Range
s -[Flags,l length]su Range
s -[Flags]v Range Object
```

--------------------------------

### Loaded Modules and Image Information

Commands for listing and inspecting loaded modules and image information.

```APIDOC
## Loaded Modules and Image Information

### Description
Commands to list and retrieve detailed information about loaded modules and their images.

### Commands

- **lm**
  - **Description**: Lists loaded modules.
  - **Variants**: `lmv` (verbose), `lmi` (with loaded symbols), `lmk` (kernel only), `lmu` (user only), `lmf` (image path), `lm m Pattern` (filter by module name pattern).
  - **Note**: `lmD` is a DML mode of `lm`.

- **!dlls**
  - **Description**: Lists all loaded modules with load count.
  - **Variants**: `!dlls -i` (by initialization order), `!dlls -l` (by load order - default), `!dlls -m` (by memory order), `!dlls -v` (with version info), `!dlls -c ModuleAddr` (only module at ModuleAddr), `!dlls -?` (brief help).

- **!imgreloc**
  - **Description**: Displays information about relocated images.
  - **Parameter**: `ImgBaseAddr` (Image base address).

- **!lmi**
  - **Description**: Displays detailed information about a module, including exact symbol info.
  - **Parameter**: `Module` (Module name).

- **!dh**
  - **Description**: Dumps headers for a given image base address.
  - **Parameter**: `ImgBaseAddr` (Image base address).
  - **Variants**: `!dh -f` (file headers only), `!dh -s` (section headers only), `!dh -h` (brief help).
  - **Note**: `!lmi` is often more useful than `!dh` for a concise summary.

### Examples
- `lm`
- `lmv m kernel32`
- `lmD`
- `!dlls -v -c kernel32`
- `!lmi kernel32`
- `!dh kernel32`
```

--------------------------------

### Inspect Heap Structures in WinDbg

The '!heap' extension provides comprehensive tools for heap analysis. It can list heaps, display detailed heap information, validate heaps, summarize memory usage, and search for blocks or leaked blocks. Extended page heap options are also available.

```WinDbg CLI
!heap -?
!heap
!heap -h [HeapAddr | Idx | 0]
!heap -v [HeapAddr | Idx | 0]
!heap -s [HeapAddr | 0]
!heap -i [HeapAddr]
!heap -x [-v] Address
!heap -l
!heap -b, -B
!heap -flt | !heap -flt s Size
!heap -flt r SizeMin SizeMax
!heap -stat | !heap -stat -h [HeapHandle | 0]
!heap -p | !heap -p -?
!heap -p
!heap -p -h HeapHandle
!heap -p -a UserAddr
!heap -p -all
```

--------------------------------

### Logging Extension Enable/Disable Commands (!loge, !logd)

Commands to manage the logging extension (logexts.dll). !loge enables logging and can optionally specify an output directory, while !logd disables logging.

```windbg
!loge [dir]
!logd

```

--------------------------------

### Conditional and Delayed Breakpoints in WinDbg

Explains how to set breakpoints that trigger only once, after a certain number of passes, or based on specific conditions.

```windbg
bp mod!addr /1
bp mod!addr k
```

--------------------------------

### Breakpoint Listing (bl)

Lists all currently set breakpoints. This is a fundamental command for understanding the current breakpoint configuration.

```debugger
bl
```

--------------------------------

### DML Code Flow Exploration

Command for interactive exploration of code flow using DML.

```APIDOC
## .dml_flow

### Description
Allows for interactive exploration of code flow for a function. It builds a code flow graph starting from a given address and displays the basic block for a target address, including links to referring and referred blocks.

### Method
None (Command)

### Endpoint
N/A

### Parameters
- **StartAddr** (address) - Required - The starting address for building the code flow graph.
- **TargetAddr** (address) - Required - The target address within the function to display the basic block for.

### Request Example
```
.dml_flow CreateRemoteThread CreateRemoteThread+30
```

### Response
N/A (Command execution, displays code flow graph and related information)
```

--------------------------------

### Logging Extension Buffer Commands (!logb)

Handles buffer operations for the logging extension. Commands include printing buffer contents to the debugger or flushing the buffer to log files.

```windbg
!logb p
!logb f

```

--------------------------------

### DML Enhanced Help and Information Commands

Commands that provide DML-enhanced help and information retrieval.

```APIDOC
## .help /D

### Description
Activates a DML mode for the `.help` command, presenting a top bar of links for easier navigation of help topics.

### Method
None (Command)

### Endpoint
N/A

### Parameters
None

### Request Example
```
.help /D
```

### Response
N/A (Command execution)

---

## .chain /D

### Description
Enables a DML mode for the `.chain` command, linking extensions to `.extmatch` for better discoverability.

### Method
None (Command)

### Endpoint
N/A

### Parameters
None

### Request Example
```
.chain /D
```

### Response
N/A (Command execution)

---

## .extmatch /D

### Description
Applies a DML format to the `.extmatch` command, where exported functions are linked to `!ExtName.help FuncName` commands.

### Method
None (Command)

### Endpoint
N/A

### Parameters
None

### Request Example
```
.extmatch /D
```

### Response
N/A (Command execution)

---

## lmD

### Description
Activates a DML mode for the `lm` command, where module names are linked to `lmv` commands for detailed module information.

### Method
None (Command)

### Endpoint
N/A

### Parameters
None

### Request Example
```
lm D
```

### Response
N/A (Command execution)

---

## kM

### Description
Activates a DML mode for the `k` command, where frame numbers are linked to `.frame/dv` commands for detailed frame and variable inspection.

### Method
None (Command)

### Endpoint
N/A

### Parameters
None

### Request Example
```
kM
```

### Response
N/A (Command execution)
```

--------------------------------

### WinDbg Heap Analysis Command (!heap)

Uses the !heap command with specific flags to analyze heap information, particularly focusing on retrieving stack traces for allocated memory. Requires a user address obtained from memory allocation.

```windbg
!heap -p -a [UserAddr]

```

--------------------------------

### Source File Management Commands

Commands for managing source file search paths and debugging features in WinDbg.

```APIDOC
## Source File Management Commands

### Description
Commands used to configure source file search paths and control source-level debugging features.

### Commands

#### `.srcpath`

- **Description**: Displays or sets the source file search path.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A
- **Parameters**:
  - **Query Parameters**:
    - `+ DIR` (string) - Optional - Appends the specified directory to the source search path.

#### `.srcnoisy`

- **Description**: Controls whether source file loading is noisy (i.e., displays detailed loading information).
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A
- **Parameters**:
  - **Path Parameters**:
    - `{1|0}` (integer) - Required - 1 to enable noisy source loading, 0 to disable.

#### `.lines`

- **Description**: Toggles source line support on or off.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A
- **Parameters**:
  - **Query Parameters**:
    - `-e` (flag) - Enables source line support.
    - `-d` (flag) - Disables source line support.
    - `-t` (flag) - Toggles source line support.

#### `l` (lowercase L)

- **Description**: Commands related to showing or suppressing line numbers in disassembly or source views.
- **Method**: N/A (Debugger Command)
- **Endpoint**: N/A
- **Parameters**:
  - **Query Parameters**:
    - `l+l` - Show line numbers.
    - `l-l` - Suppress line numbers.
    - `l+o` - Show all line information.
    - `l-o` - Suppress all but specific line info.
    - `l+s` - Show source file names.
    - `l-s` - Suppress source file names.
    - `l+t` - Show line numbers and source file names.
    - `l-t` - Suppress line numbers and source file names.

### Request Example

```
.srcpath+ C:\MySources
.lines -e
l+l
```

### Response Example

*(Output varies based on the command and debugger state; typically confirmations or status updates)*
```

--------------------------------

### Logging Extension Category Management (!logc)

Manages logging categories for the logging extension. Commands allow listing categories, displaying APIs within a category, and enabling or disabling specific categories.

```windbg
!logc
!logc p #
!logc [e|d] *
!logc [e|d] # [#] [#]

```

--------------------------------

### Manage Aliases and Breakpoints (WinDbg)

This section provides WinDbg commands for managing aliases and breakpoints. It includes commands to list aliases ('al'), list breakpoints ('bl'), delete all aliases ('ad ***'), and reset breakpoints, which can help resolve issues caused by corrupted alias mappings.

```windbg
al
```

```windbg
bl
```

```windbg
ad ***
```

--------------------------------

### Exceptions, Events, and Crash Analysis

Commands for analyzing exceptions, events, and crashes in WinDbg.

```APIDOC
## Exceptions, Events, and Crash Analysis

### Description
Commands to manage and analyze exceptions, events, and general crash information.

### Commands

- **g, gH, gN**
  - **Description**: Control program execution.
  - **Variants**: `g` (Go), `gH` (Go exception handled), `gN` (Go not handled).

- **.lastevent**
  - **Description**: Displays the most recent event or exception that occurred.

- **!analyze**
  - **Description**: Displays information about the current exception or bug check.
  - **Variants**: `!analyze -v` (verbose), `!analyze -hang` (analyze hang), `!analyze -f` (see exception analysis when not detected).

- **sx**
  - **Description**: Manages event filters.
  - **Variants**: `sx` (show all filters), `sxe` (break on exception), `sxd` (don't break on exception), `sxn` (notify, don't break), `sxi` (ignore event), `sxr` (reset filter settings).

- **.exr**
  - **Description**: Displays exception records.
  - **Variants**: `.exr -1` (most recent), `.exr Addr` (at specific address).

- **.ecxr**
  - **Description**: Displays the exception context record (registers) associated with the current exception.

- **!cppexr**
  - **Description**: Displays the content and type of a C++ exception.
  - **Variants**: `!cppexr Addr` (at specific address).

### Examples
- `g`
- `.lastevent`
- `!analyze -v`
- `sx`
- `.exr -1`
- `!cppexr 7c901230`
```

--------------------------------

### Logging Extension Module List Commands (!logm)

Manages the module inclusion or exclusion list for the logging extension. This allows fine-tuning which modules are monitored for logging events.

```windbg
!logm
!logm [i|x] [DLL] [DLL]

```

--------------------------------

### Logging Extension Commands in WinDbg

This section outlines commands for the logging extension (logexts.dll) in WinDbg. It covers enabling, disabling, and configuring logging, as well as managing log categories and output settings. These commands are crucial for detailed tracing of application behavior.

```WinDbg
!logexts.help
```

```WinDbg
!loge [dir]
```

```WinDbg
!logi
```

```WinDbg
!logd
```

```WinDbg
!logo
```

```WinDbg
!logo [e|d] [d|t|v]
```

```WinDbg
!logc
```

```WinDbg
!logc p #
```

```WinDbg
!logc [e|d] *
```

```WinDbg
!logc [e|d] # [#] [#]
```

```WinDbg
!logb p
```

```WinDbg
!logb f
```

```WinDbg
!logm
```

```WinDbg
!logm [i|x] [DLL] [DLL]
```

--------------------------------

### Display Local Variables (WinDbg)

Command to display local variables, parameters, and their types, memory addresses, or register locations. Supports filtering by pattern and sorting the output by address, name, or size.

```windbg
dv
dv **Pattern**
dv [**/i /t /V**] [Pattern]
dv [/i /t /V **/a /n /z**] [Pattern]
dv /t /i /V
```

--------------------------------

### Process Related Information

Commands for retrieving information about processes.

```APIDOC
## Process Related Information

### Description
Commands to display and interact with process information.

### Commands

- **!dml_proc**
  - **Description**: (DML) Displays current processes and allows drilling into them for more information.

- **| (pipe)**
  - **Description**: Prints the status of all processes being debugged.

- **.tlist**
  - **Description**: Lists all processes running on the system.

- **!peb**
  - **Description**: Displays a formatted view of the process's environment block (PEB).

### Examples
- `!dml_proc`
- `|`
- `.tlist`
- `!peb`
- `dt ntdll!_PEB @$peb -r`
```
Tokens:
Raw