Debug on Windows using WinDbg

DebugWithWindbg.md

Links:

• WDK and WinDbg downloads
• UnOfficial Windows 10 Windbg

Get WinDbg

• goto WDK and WinDbg downloads
• scroll down to Standalone Debugging Tools for Windows (WinDbg)
• Get the standalone debugging tools (WinDbg) as part of Windows 8.1 SDK
• execute sdksetup.exe
• just select Debugging Tools for Windows
• install

Use WinDbg

Prepare for crash

• Start -> All Programs -> Windows Kits -> Debugging Tools for Windows (x64) -> WinDbg (x64)
• File -> Open -> Executable:
  • File name:C:\Program Files\mapbox-studio\resources\app\vendor\node.exe
  • Arguments: "C:\Program Files\mapbox-studio\resources\app\index.js"
  • check Debug child processes also
• Check in Task Manager that there is only one instance of node.exe
• Enter commands one at a time on the prompt at the bottom

.sympath SRV*C:\debugsymbols*http://msdl.microsoft.com/download/symbols
.symfix+ c:\debugsymbols
!sym noisy
.reload /f

• wait till *BUSY* at the bottom left disappears
• Enter commands one at a time on the prompt at the bottom

.logopen /t c:\mbslog\log.txt
.childdbg 1
.tlist
|* lm

• now run mbs by: Debug -> Go

If you see an exception in the WinDbg command window that says ntdll32!LdrpDoDebuggerBreak+0x2c or ntdll32!LdrpDoDebuggerBreak+0x30, enter those commands:

bp ntdll!LdrpDoDebuggerBreak+0x30
bp ntdll!LdrpDoDebuggerBreak+0x2c
eb ntdll!LdrpDoDebuggerBreak+0x30 0x90
eb ntdll!LdrpDoDebuggerBreak+0x2c 0x90
----
To continue click: Debug -> Go

• open your browser at http://localhost:3000
• reproduce crash

After the crash

• Enter commands:

!peb
.reload /f
!teb
|* ~* kp
|* !analyze -v -f
|* lm

• Create a dump file (might take some time): .dump /ma c:\mbslog\mbs-crash.dmp
• exit WinDbg
• the DMP files can be huge, but they compress really well with 7z (www.7-zip.org) and compression set to Ultra.
• send log and 7-zipped dump files from c:\mbslog\ to developer, who pointed you to this gist

Use WinDbg on DotNet

1. Point Symbol path for code .pdb files
   • Example: .sympath D:\MyAspNetcode\bin;cache*;SRV*https://msdl.microsoft.com/download/symbols;C:\ProgramData\Dbg\sym\kernelbase.pdb\E4F19BFB5CC054D7E381DBC8D97493691
2. Add SOS.dll to WinDBG understand .Net
   • .load D:\PATH\sos.dll
   • SOS.dll was found on .Net framework folder
3. Adding CoreClr (Not real understand, but needed)
   • .cordll -I coreclr.dll -N -ve

References

Command references

1. !peb - Show "Dump machine" system information.
2. !runaway - Show what is running on the "Dump time".
3. ~s - Go focus on thread number. Command example: ~4s, moves to thread 4.
4. kb - On thread, this command show the Stack was running on the moment.
5. .sympath - Add references to new Symbol path, used when work with nom C code.
6. !clrstack - Show Dotnet Stack
7. !ip2md - Detail to point of Memory (ip2md = internal point to memory definition). Ex: "!ip2md 00007ffe4ec4910"

###General

• Defrag Tools
  • ProcDump Intro
  • ProcDump Triggers
  • ProcDump Win8 & Process Monitor
• Roberto Alexis Farah: Debugging ToolBox
• Tools for Your Debugging Toolbox

WinDbg General

• Common WinDbg Commands
• How do I make a '.cmdtree' window dock at startup in WinDbg?
• What is your favourite Windbg tip/trick?
• Special Command—Execute Commands from a Customized User Interface with .cmdtree

Stack Trace

• How to get a stacktrace with WinDbg
• Using the Mozilla symbol server
• How to get the stack when 'k' tells you 'Stack unwind information not available. Following frames may be wrong
• Reconstructing a Corrupted Stack Crawl
• Debug Tutorial Part 2: The Stack

Memory

!address -summary -> build memory map
!heap -s -> heap summary
!heap -stat -h 0 -> allocation statistics
!heap -srch [Size] <pattern> -> scan all heap for pattern
!heap -flt s <obj-size> -> filter heap by object size
filter all loaded modules by object size:
!for_each_module ".echo @#ModuleName;dt -v -s <obj-size>  ${@#ModuleName}!*"

• Memory Leak Detection Using Windbg
• Investigating issues with Unmanaged Memory
• Debugging OOM
• debugging memory problems – a beginner’s view