Windbg Reference

Sometimes I paste debugger spew. In this debugger spew, there are invariably debugger commands. If you don't know Windbg commands, these can render the spew incomprehensible. To help a little, I'm putting up this page as a quick reference for commands that I actually use in posts. If you want a full reference, go get the actual debugger package and look at the CHM file, which is very thorough.

Commands

bl

List current breakpoints.

bu <symbol>

Set a breakpoint on the specified symbol.

db <addr> [L<count>]

Display count bytes starting from addr. Also displays ASCII decoding of the bytes off to the side.

gu

Step out of the current function call.

dd <addr> [L<count>]

Display count double words starting from addr.

p

Step over instruction (do not step into function call).

pct

Step to next call or ret instruction.

r [<reg> [= <expr>]]

Display all registers, display a single register, or set a register's value.

t

Step into function.

x <pattern>

Examine symbols, allowing wildcard matches. I usually use it to look up function names in a module.