Windbg New Features - Windows 10 (v10.0.10075.9)

jcgriff2

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)
Staff member
Joined
Feb 19, 2012
Posts
21,541
Location
New Jersey Shore
I found a few surprises in Windbg 10.0.10075.9

There are many additional clickable fields; !analyze -v contains system and BIOS information now.

Unfortunately, copy/paste does not pick up the hyperlink fields, but I have described a few below.

!analyze -v (full):

Read More:

!analyze -v system, BIOS info
Code: 
SYSTEM_SKU:  ASUS-NotebookSKU
SYSTEM_VERSION:  1.0       
BIOS_DATE:  09/11/2013
BASEBOARD_PRODUCT:  N46JV
BASEBOARD_VERSION:  1.0


kv command now contains the .frame command for each line (the first 2 digits appear blue in Windbg 10) - not much help in a minidump though.

The first line - 00- command = .frame 0n0;dv /t /v
Code: 
2: kd> kv
 # Child-SP          RetAddr           : Args to Child                                                           : Call Site
[B][COLOR=#0000ff]00[/COLOR][/B] ffffd000`d70b7578 fffff800`d2f2df56 : 00000000`000000c2 00000000`00000007 00000000`00001200 00000000`cd6cc1d9 : nt!KeBugCheckEx
[B][COLOR=#0000ff]01[/COLOR][/B][COLOR=#000000] ffffd000[/COLOR]`d70b7580 fffff800`f68ded43 : 00000000`00004000 ffffe001`17130e6c ffffe001`171307f0 00000000`0000006c : nt!ExFreePool+0x26a
[B][COLOR=#0000ff]02 [/COLOR][/B][COLOR=#000000]ffffd0[/COLOR]00`d70b7670 fffff800`f68de612 : 00000000`00000000 00000000`00004000 fffff800`f68d6010 fffff800`f68bbb36 : FLTMGR!FltReleaseFileNameInformation+0xc3
[B][COLOR=#0000ff]03[/COLOR][/B] ffffd000`d70b76b0 fffff800`f68b44c0 : ffffe001`171307f0 ffffe001`1b07d500 ffffe001`19478000 ffffe001`1b07d500 : FLTMGR!FltpRemoveAllNamesCachedForFileObject+0x1c2
[B][COLOR=#0000ff]04[/COLOR][/B][COLOR=#000000] ffffd000[/COLOR]`d70b7730 fffff800`f68b55ac : ffffd000`d70b7940 ffffe001`1b07d500 00000000`00000000 ffffd000`d70b7802 : FLTMGR!FltpPerformPreCallbacks+0x720
[COLOR=#0000ff][B]05[/B][/COLOR] ffffd000`d70b7840 fffff800`f68b35ce : ffffe001`18445450 00000000`00000000 ffffe001`1adf7b20 ffffe001`00000000 : FLTMGR!FltpPassThroughInternal+0x8c
[COLOR=#0000ff][B]06[/B][/COLOR] ffffd000`d70b7870 fffff800`f68b30aa : ffffe001`1712db10 ffffe001`1adf7780 ffffe001`1adf7780 ffffe001`170f5c60 : FLTMGR!FltpPassThrough+0x2be
[COLOR=#0000ff][B]07[/B][/COLOR] ffffd000`d70b7920 fffff800`d302db58 : ffffe001`1b07d500 ffffe001`17128030 ffffe001`1adf7780 00000000`00000001 : FLTMGR!FltpDispatch+0x9a
[COLOR=#0000ff][B]08[/B][/COLOR] ffffd000`d70b7980 fffff800`d3054160 : 00000000`00000000 ffffe001`1b07d500 ffffe001`170f5c60 ffffe001`1b07d4d0 : nt!IopDeleteFile+0x128
[COLOR=#0000ff][B]09[/B][/COLOR] ffffd000`d70b7a00 fffff800`d2cf353f : 00000000`00000000 00000000`00000001 ffffe001`1b07d500 00000000`00000000 : nt!ObpRemoveObjectRoutine+0x64
[COLOR=#0000ff][B]0a[/B][/COLOR] ffffd000`d70b7a60 fffff800`d30a77e6 : 00000000`000800a1 ffffe001`1850f520 ffffe001`000800a1 00000000`00000000 : nt!ObfDereferenceObject+0x8f
[COLOR=#0000ff][B]0b[/B][/COLOR] ffffd000`d70b7aa0 fffff800`d2da2c48 : fffff800`d2fe4000 ffffd000`d70b7b50 ffffe001`1850f528 00000000`00000000 : nt!MiSegmentDelete+0x11e
[COLOR=#0000ff][B]0c[/B][/COLOR] ffffd000`d70b7ae0 fffff800`d2dc10bd : 00000000`00000000 fffff800`d2f627a0 ffffe001`170f2800 00000000`00000012 : nt!MiProcessDereferenceList+0x100
[COLOR=#0000ff][B]0d[/B][/COLOR] ffffd000`d70b7b70 fffff800`d2d61280 : ffffe001`1722a880 00000000`00000080 ffffe001`1722a880 00000000`00000000 : nt!MiDereferenceSegmentThread+0xd9
[COLOR=#0000ff][B]0e[/B][/COLOR] ffffd000`d70b7c00 fffff800`d2ddffc6 : ffffd000`db2f5180 ffffe001`1722a880 ffffd000`db3013c0 00000000`00000000 : nt!PspSystemThreadStartup+0x58
[COLOR=#0000ff][B]0f [/B][/COLOR]ffffd000`d70b7c60 00000000`00000000 : ffffd000`d70b8000 ffffd000`d70b2000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

Clicking on 00 resulted:
Code: 
2: kd>[B] .frame 0n0;dv /t /v[/B]
00 ffffd000`d70b7578 fffff800`d2f2df56 nt!KeBugCheckEx
Unable to enumerate locals, HRESULT 0x80004005
Private symbols (symbols.pri) are required for locals.
Type ".hh dbgerr005" for details.

In the loaded driver listing, both the module name heading itself is blue and hyper (command = lmDtnsm + same for each individual driver name (command = lmDvmFLTMGR (FLTMGR is of course a driver name)

The result of the latter (individual driver name) -- with additional hyper fields:
Code: 
[B]2: kd> [COLOR=#ff0000]lmDvmFLTMGR[/COLOR][/B]
[COLOR=#0000ff][B]Browse full module list[/B][/COLOR]
start             end                 module name
fffff800`f68b2000 fffff800`f690e000   [COLOR=#0000ff][B]FLTMGR[/B][/COLOR]     (pdb symbols)          c:\symbols\fltMgr.pdb\ACF4EF6122C14FD5A8323B3F55B630722\fltMgr.pdb
    Loaded symbol image file: FLTMGR.SYS
    Mapped memory image file: c:\symbols\FLTMGR.SYS\53FBF00C5c000\FLTMGR.SYS
    Image path: \SystemRoot\system32\DRIVERS\FLTMGR.SYS
    Image name: FLTMGR.SYS
    [COLOR=#0000ff][B]Browse all global symbols[/B][/COLOR]  [B][COLOR=#0000ff]functions[/COLOR][/B]  [B][COLOR=#0000ff]data[/COLOR][/B]
    Timestamp:        Mon Aug 25 22:25:16 2014 (53FBF00C)
    CheckSum:         0005F90F
    ImageSize:        0005C000
    File version:     6.3.9600.17326
    Product version:  6.3.9600.17326
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     fltMgr.sys
    OriginalFilename: fltMgr.sys
    ProductVersion:   6.3.9600.17326
    FileVersion:      6.3.9600.17326 (winblue_r3.140825-1335)
    FileDescription:  Microsoft Filesystem Filter Manager
    LegalCopyright:   © Microsoft Corporation. All rights reserved.


*** Load W10 Windbg and try it out! - http://go.microsoft.com/fwlink/p/?LinkId=536682

From: https://msdn.microsoft.com/en-us/windows/hardware/dn913721(v=vs8.5).aspx?f=255&MSPPError=-2147217396



The entire dump output - !analyze -v;kv;lmnt
Read More:
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top