Defrag Tools: #26 - WinDbg - Semaphores, Mutexes and Timers
Description
In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer.
This installment goes over the cables and configuration steps required to set up kernel mode debugging.
We use these BCDEdit commands:
- bcdedit
- bcdedit /dbgsettings
- bcdedit /dbgsettings 1394 channel:42
- bcdedit /dbgsettings net hostip:192.168.0.10 port:50000 key:a.b.c.d
- bcdedit /debug on
- bcdedit /debug off
In the debug session, we use these commands:
- .crash
- .dump /f
- lm
- !lmi
- .reload /f
- !drvobj
- !drvobj <module> 2
- bl
- bc *
- be <N>
- bd <N>
- bp <function>
- bm <wildcard>
- x <wildcard>
- g
Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.
Resources:
NT Debugging Blog - How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining
NT Debugging Blog - Remoting Your Debug Crash Cart With KDNET [10th May 2013]
USBView
USB3 Debugging Cable
- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box!
Timeline:
[00:45] - Kernel Debugging Cables
[02:14] - USB 2.0
[04:13] - USB 3.0 - New in Windows 8/Windows RT
[05:30] - 1394 (Firewire)
[10:39] - Break
[11:38] - Driver Objects
[16:00] - Network - New in Windows 8/Windows RT
[17:30] - Breakpoint commands
[26:00] - Network - BCDEdit
[33:37] - SecureBoot and BitLocker
Share
Download
Download this episode
- MP3 (34.1 MB)
- Low Quality MP4 (205.0 MB)
- Mid Quality WMV (126.6 MB)
- High Quality MP4 (448.8 MB)
- Mid Quality MP4 (313.6 MB)
- High Quality WMV (310.0 MB)
More episodes in this series
Defrag Tools: #28 - WinDbg - Scheduling
Related episodes
Defrag Tools: #30 - MCTS Windows Internals
Defrag Tools: #29 - WinDbg - ETW Logging
Defrag Tools: #28 - WinDbg - Scheduling
Defrag Tools: #26 - WinDbg - Semaphores, Mutexes and Timers
Defrag Tools: #25 - WinDbg - Events
Defrag Tools: #24 - WinDbg - Critical Sections
Defrag Tools: #23 - Windows 8 SDK
Defrag Tools: #20 - WinDbg - Basic Commands
Managed Exceptions - 06
High CPU Hangs - 05
The Discussion
-
Edward Great show.
btw as a little tid-bit of info... IEEE1394/FireWire is actually the first form of serialized SCSI. Thus why it has channels 0..63 - it's the number of SCSI id's/slots on a SCSI bus. The electrical transport specifications of 1394 has seen been obsoleted when connecting to hard drives. SAS (Serial Attached SCSI) Hard Drives now use the Nexus electrical standard - which is everywhere - GigE, PCIe, HDMI, SATA, SAS. The 1394 protocol lives on today in the SAS communciation protocol. -
ChadBeeder Brownie points to the first person who can tell me why my modem.sys breakpoint didn't get hit! I went back and watched the show later and figured out my mistake.
-
dtower Really like the whole series. This episode was good because the few times I've had to do this it was a bit of a pain so I'm glad this was covered.
Serial Tablet Larry? That's some solid hardware; just keeps on ticking.
-
ajasmin @ChadBeeder Re-watched that part a few times. At first I though you had left that breakpoint disabled but that doesn't seem to be the case. Perhaps the modem wasn't powered on in the first place and that function is never called?
Anyway I'll be checking back to see if someone figures it out.
-
windev Even I couldn't work it out - I guessed the same as you, that it was a disabled breakpoint or it wasn't powered on. Chad said he'd answer it on the episode we tape tomorrow, and air on Monday.
-
FFE Liked the show. Really nice.
I watch the part where the breakpoint was set on modem!ModemPower twice. My guess is the breakpoint needed to be on a different function? modem!PowerPnP? Maybe?
-
ChadBeeder @FFE: You got it! I set the breakpoint on the dispatch routine for IRP_MJ_POWER (modem!ModemPower), then disabled the modem in device manager, which would result in, not a power IRP, but a Plug and Play IRP (IRP_MJ_PNP).
I should have set the breakpoint on modem!ModemPnP instead of modem!ModemPower.
-
Simon Crispin Glover?
-
MagicAndre1981 Enabling Debug mode causes Windows to hang if no Debugger is connected
-
charles thank you
-
crb9922 great page thank you