windbg1111 Cheat Sheet by GA11

.reload /f

.sympath .SRVC:\symhttp:/­/ms­dl.m­ic­ros­oft.co­m/d­own­loa­d/s­ymbols/

$iment­(mo­dule)

entry point of module

!devobj <na­me>

device object

bp 0x<­add­r>

set breakpoint at address

bd <#>

disable breakp­oint#

be <#>

enable breakpoint #

bu <sy­mbo­lna­me>

break on symbol

g or F5

continue

t or F11

step into

wt

trace and watch

pa or ta 0x<­add­r>

step to address

pt or tt

step to next return

ph or th

step to next branch

F6 or .attach

attach to process

.restart

retstart

a

~<a><b>

.

current threads

b

~<a­><b>

f

freeze

n

supsend

empty lists threads

k

dump all stack

!teb

dump TEB

!vadump

dump mem pages/info

lm

list loaded modules

!idt

interrupt descriptor table

u 0x<­add­r> L<a­ddr>

disass­emble at addr L# instru­ctions

d* 0x<­add­r>

u