Skip to content


  • !locks

Hang analysis#

  • !analyze -v -hang
  • Look at the stack and rerun the stack dump command (eg: ~0s ; .cxr ; kb)
  • Most likely will be NtWaitForSingleObject.  Grab the handle pointer and fe


  • !uniqstack 
  • !findstack

Crash Dump Analysis#

Use windbg.exe to open dump file

Use following command: !analyze -v

Debugging BSOD/Bugcheck:

Live Kernel Mode Debugging:

System File Checker:

BSOD/Crash Dump/Minidump: BlueScreenView


Misc Commands#

Debug Commands: k: Display backtrace

WinDBG: bp Address breakpoint bu Unresolved/deferred breakpoint. Persists across module load/unload bm Set symbol breakpoint on pattern match bc/bd/be Clear/enable/disable BP

Can also do breakpoint commands. Ex: 0:000> bu MyFunction+0x47 “.dump c:\mydump.dmp; g”

bl List existing breakpoints ba Set Read Data breakpoint

Complex DataAccess breakpoints:

Last update: November 17, 2020