Windows windbg -- lm (List module)

For Windows 8.1 x64 OS, windbg lm command can list Windows module.  It help us to understand Windows driver image location.  There are 3 groups for the drivers.  kdcom.dll, ntoskrnl.exe, hal.dll is one group(FFFFF800xxxxxxxx).  win32k.sys, TSDDD.dll,cdd.dll, and ATMFD.dll is one group(FFFFF960xxxxxxxx).  The others is one group(FFFFF880xxxxxxxx).

0: kd> lm
start             end                 module name
fffff800`00bc3000 fffff800`00bcd000   kdcom      (deferred)
fffff800`02e03000 fffff800`033d4000   nt         (pdb symbols)         
fffff800`033d4000 fffff800`0341d000   hal        (deferred)
fffff880`00c00000 fffff880`00cc0000   CI         (deferred)
fffff880`00cd4000 fffff880`00ce1000   mcupdate_AuthenticAMD   (deferred)
fffff880`00ce1000 fffff880`00cf5000   PSHED      (deferred)
fffff880`00cf5000 fffff880`00d53000   CLFS       (deferred)
fffff880`00d53000 fffff880`00daf000   volmgrx    (deferred)
fffff880`00daf000 fffff880`00dd9000   ataport    (deferred)
fffff880`00dd9000 fffff880`00de4000   msahci     (deferred)
fffff880`00de4000 fffff880`00dfb000   amd_sata   (deferred)
fffff880`00e00000 fffff880`00e0a000   msisadrv   (deferred)
fffff880`00e0a000 fffff880`00e3d000   pci        (deferred)
fffff880`00e3d000 fffff880`00e4a000   vdrvroot   (deferred)
fffff880`00e4a000 fffff880`00e5f000   partmgr    (deferred)
fffff880`00e5f000 fffff880`00e68000   compbatt   (deferred)
fffff880`00e68000 fffff880`00e74000   BATTC      (deferred)
fffff880`00e74000 fffff880`00e89000   volmgr     (deferred)
fffff880`00e89000 fffff880`00e90000   pciide     (deferred)
fffff880`00e90000 fffff880`00ea0000   PCIIDEX    (deferred)
fffff880`00ea0000 fffff880`00eba000   mountmgr   (deferred)
fffff880`00eba000 fffff880`00ec3000   atapi      (deferred)
fffff880`00ec8000 fffff880`00f8a000   Wdf01000   (deferred)
fffff880`00f8a000 fffff880`00f9a000   WDFLDR     (deferred)
fffff880`00f9a000 fffff880`00ff1000   ACPI       (deferred)
fffff880`00ff1000 fffff880`00ffa000   WMILIB     (deferred)
fffff880`01025000 fffff880`01087000   storport   (deferred)
fffff880`01087000 fffff880`01094000   amd_xata   (deferred)
fffff880`01094000 fffff880`0109f000   amdxata    (deferred)
fffff880`0109f000 fffff880`010eb000   fltmgr     (deferred)
fffff880`010eb000 fffff880`0115c000   SYMDS64    (deferred)
fffff880`0115c000 fffff880`01170000   fileinfo   (deferred)
fffff880`01170000 fffff880`011bc000   volsnap    (deferred)
fffff880`011bc000 fffff880`011f6000   rdyboost   (deferred)
fffff880`01200000 fffff880`0125e000   msrpc      (deferred)
fffff880`0125e000 fffff880`012d0000   cng        (deferred)
fffff880`012f0000 fffff880`013d4000   SYMEFA64   (deferred)
fffff880`013d4000 fffff880`013e0040   PxHlpa64   (deferred)
fffff880`01400000 fffff880`0141a000   ksecdd     (deferred)
fffff880`0141a000 fffff880`0142b000   pcw        (deferred)
fffff880`0142b000 fffff880`01435000   Fs_Rec     (deferred)
fffff880`01453000 fffff880`015f4000   Ntfs       (deferred)
fffff880`01600000 fffff880`01649000   fwpkclnt   (deferred)
fffff880`0164b000 fffff880`0173d000   ndis       (deferred)
fffff880`0173d000 fffff880`0179d000   NETIO      (deferred)
fffff880`0179d000 fffff880`017c8000   ksecpkg    (deferred)
fffff880`017c8000 fffff880`017d0000   spldr      (deferred)
fffff880`017d0000 fffff880`017e2000   mup        (deferred)
fffff880`017e2000 fffff880`017eb000   hwpolicy   (deferred)
fffff880`01802000 fffff880`019ff000   tcpip      (deferred)
fffff880`01a27000 fffff880`01a61000   fvevol     (deferred)
fffff880`01a61000 fffff880`01a77000   disk       (deferred)
fffff880`01a77000 fffff880`01aa7000   CLASSPNP   (deferred)
fffff880`01ae9000 fffff880`01b13000   cdrom      (deferred)
fffff880`01b13000 fffff880`01b1c000   Null       (deferred)
fffff880`01b1c000 fffff880`01b23000   Beep       (deferred)
fffff880`01b23000 fffff880`01b33000   RegHiveRecovery   (deferred)
fffff880`01b33000 fffff880`01b41000   vga        (deferred)
fffff880`01b41000 fffff880`01b66000   VIDEOPRT   (deferred)
fffff880`01b66000 fffff880`01b76000   watchdog   (deferred)
fffff880`01b76000 fffff880`01b7f000   RDPCDD     (deferred)
fffff880`01b7f000 fffff880`01b88000   rdpencdd   (deferred)
fffff880`01b88000 fffff880`01b91000   rdprefmp   (deferred)
fffff880`01b91000 fffff880`01b9c000   Msfs       (deferred)
fffff880`01b9c000 fffff880`01bad000   Npfs       (deferred)
fffff880`01bad000 fffff880`01bcb000   tdx        (deferred)
fffff880`01bcb000 fffff880`01bd8000   TDI        (deferred)
fffff880`01bd8000 fffff880`01bf0000   BTHUSB     (deferred)
fffff880`03a00000 fffff880`03a20000   bthpan     (deferred)
fffff880`03a20000 fffff880`03a44e00   btath_rcp   (deferred)
fffff880`03a45000 fffff880`03aac000   btath_a2dp   (deferred)
fffff880`03ac8000 fffff880`03b54000   bthport    (deferred)
fffff880`03b54000 fffff880`03b65000   WinUSB     (deferred)
fffff880`03b65000 fffff880`03ba5000   RtsUStor   (deferred)
fffff880`03ba5000 fffff880`03bd1000   rfcomm     (deferred)
fffff880`03bd1000 fffff880`03be1000   BthEnum    (deferred)
fffff880`03c14000 fffff880`03c9d000   afd        (deferred)
fffff880`03c9d000 fffff880`03ce2000   netbt      (deferred)
fffff880`03ce2000 fffff880`03ceb000   wfplwf     (deferred)
fffff880`03ceb000 fffff880`03d11000   pacer      (deferred)
fffff880`03d11000 fffff880`03d27000   vwififlt   (deferred)
fffff880`03d27000 fffff880`03d36000   netbios    (deferred)
fffff880`03d36000 fffff880`03d51000   wanarp     (deferred)
fffff880`03d51000 fffff880`03d65000   termdd     (deferred)
fffff880`03d65000 fffff880`03dcc000   SYMNETS    (deferred)
fffff880`03dcc000 fffff880`03df9200   usbvideo   (deferred)
fffff880`03e00000 fffff880`03e76000   IDSVia64   (deferred)
fffff880`03e76000 fffff880`03e85000   discache   (deferred)
fffff880`03e85000 fffff880`03ea3000   dfsc       (deferred)
fffff880`03ea3000 fffff880`03eb4000   blbdrive   (deferred)
fffff880`03eb4000 fffff880`03ec7000   dump_dumpfve   (deferred)
fffff880`03ed5000 fffff880`03f0b000   SYMEVENT64x86   (deferred)
fffff880`03f0b000 fffff880`03f38000   Ironx64    (deferred)
fffff880`03f38000 fffff880`03f4e000   SRTSPX64   (deferred)
fffff880`03f4e000 fffff880`03f9f000   rdbss      (deferred)
fffff880`03f9f000 fffff880`03fab000   nsiproxy   (deferred)
fffff880`03fab000 fffff880`03fb6000   mssmbios   (deferred)
fffff880`03fb6000 fffff880`03fd3000   usbccgp    (deferred)
fffff880`03fd3000 fffff880`03ffdc40   CtClsFlt   (deferred)
fffff880`04000000 fffff880`0404f000   atikmpag   (deferred)
fffff880`0404f000 fffff880`04070000   raspptp    (deferred)
fffff880`04070000 fffff880`040b3000   ks         (deferred)
fffff880`040b3000 fffff880`040c5000   umbus      (deferred)
fffff880`040c5000 fffff880`041b0000   BHDrvx64   (deferred)
fffff880`041b0000 fffff880`041d6000   tunnel     (deferred)
fffff880`041d6000 fffff880`041ee000   amdhub30   (deferred)
fffff880`041ee000 fffff880`041fc000   monitor    (deferred)
fffff880`04200000 fffff880`0426a000   Rt64win7   (deferred)
fffff880`0426a000 fffff880`0428e000   rasl2tp    (deferred)
fffff880`0428e000 fffff880`04299000   btath_bus   (deferred)
fffff880`042a0000 fffff880`04394000   dxgkrnl    (deferred)
fffff880`04394000 fffff880`043da000   dxgmms1    (deferred)
fffff880`043da000 fffff880`043fe000   HDAudBus   (deferred)
fffff880`04a00000 fffff880`04a2f000   ndiswan    (deferred)
fffff880`04a2f000 fffff880`04a4a000   raspppoe   (deferred)
fffff880`04a4a000 fffff880`04a64000   rassstp    (deferred)
fffff880`04a65000 fffff880`0538c000   atikmdag   (deferred)
fffff880`0538c000 fffff880`053e6000   Apfiltr    (deferred)
fffff880`053e6000 fffff880`053fa000   amdiox64   (deferred)
fffff880`05600000 fffff880`056a6000   peauth     (deferred)
fffff880`056b9000 fffff880`0571c000   btath_hcrp   (deferred)
fffff880`0571c000 fffff880`0572b000   btath_flt   (deferred)
fffff880`0572b000 fffff880`0573e000   btath_lwflt   (deferred)
fffff880`0573e000 fffff880`05761000   luafv      (deferred)
fffff880`05761000 fffff880`05776000   lltdio     (deferred)
fffff880`05776000 fffff880`057c9000   nwifi      (deferred)
fffff880`057c9000 fffff880`057dc000   ndisuio    (deferred)
fffff880`057dc000 fffff880`057f4000   rspndr     (deferred)
fffff880`05800000 fffff880`05804500   CmBatt     (deferred)
fffff880`05805000 fffff880`0581a000   amdppm     (deferred)
fffff880`0581a000 fffff880`0582a000   CompositeBus   (deferred)
fffff880`0582a000 fffff880`05840000   AgileVpn   (deferred)
fffff880`05840000 fffff880`0584c000   ndistapi   (deferred)
fffff880`0584c000 fffff880`0584d480   swenum     (deferred)
fffff880`05851000 fffff880`05cdb000   bcmwl664   (deferred)
fffff880`05cdb000 fffff880`05ce8000   vwifibus   (deferred)
fffff880`05ce8000 fffff880`05d18000   amdxhc     (deferred)
fffff880`05d18000 fffff880`05d19f00   USBD       (deferred)
fffff880`05d1a000 fffff880`05d29000   usbfilter   (deferred)
fffff880`05d29000 fffff880`05d34000   usbohci    (deferred)
fffff880`05d34000 fffff880`05d8a000   USBPORT    (deferred)
fffff880`05d8a000 fffff880`05d9b000   usbehci    (deferred)
fffff880`05d9b000 fffff880`05db9000   i8042prt   (deferred)
fffff880`05db9000 fffff880`05dc8000   kbdclass   (deferred)
fffff880`05dc8000 fffff880`05dd7000   mouclass   (deferred)
fffff880`05dd7000 fffff880`05df7000   sdbus      (deferred)
fffff880`05df7000 fffff880`05e00000   wmiacpi    (deferred)
fffff880`05e00000 fffff880`05e0e000   hidusb     (deferred)
fffff880`05e0e000 fffff880`05e27000   HIDCLASS   (deferred)
fffff880`05e27000 fffff880`05e2f080   HIDPARSE   (deferred)
fffff880`05e30000 fffff880`05e3d000   mouhid     (deferred)
fffff880`05e3d000 fffff880`05e49000   Dxapi      (deferred)
fffff880`05e49000 fffff880`05e57000   crashdmp   (deferred)
fffff880`05e57000 fffff880`05e61000   dump_diskdump   (deferred)
fffff880`05e61000 fffff880`05e78000   dump_amd_sata   (deferred)
fffff880`05e82000 fffff880`05edc000   usbhub     (deferred)
fffff880`05edc000 fffff880`05ef1000   NDProxy    (deferred)
fffff880`05ef1000 fffff880`05f11000   AtihdW76   (deferred)
fffff880`05f11000 fffff880`05f4e000   portcls    (deferred)
fffff880`05f4e000 fffff880`05f70000   drmk       (deferred)
fffff880`05f70000 fffff880`05f75200   ksthunk    (deferred)
fffff880`05f76000 fffff880`05ff9000   stwrt64    (deferred)
fffff880`07623000 fffff880`076eb000   HTTP       (deferred)
fffff880`076eb000 fffff880`07709000   bowser     (deferred)
fffff880`07709000 fffff880`07721000   mpsdrv     (deferred)
fffff880`07721000 fffff880`0774e000   mrxsmb     (deferred)
fffff880`0774e000 fffff880`0779c000   mrxsmb10   (deferred)
fffff880`0779c000 fffff880`077bf000   mrxsmb20   (deferred)
fffff880`077bf000 fffff880`077d1000   tcpipreg   (deferred)
fffff880`07c00000 fffff880`07c0b000   secdrv     (deferred)
fffff880`07c0b000 fffff880`07c38000   srvnet     (deferred)
fffff880`07c41000 fffff880`07df6000   rikvm_9EC60124   (deferred)
fffff880`08200000 fffff880`08236000   fastfat    (deferred)
fffff880`08236000 fffff880`0825e000   mrxdav     (deferred)
fffff880`0825e000 fffff880`08294000   WUDFRd     (deferred)
fffff880`08294000 fffff880`082af000   USBSTOR    (deferred)
fffff880`082af000 fffff880`082bc000   LiveKdD    (deferred)
fffff880`082cc000 fffff880`08333000   srv2       (deferred)
fffff880`08333000 fffff880`083c8000   srv        (deferred)
fffff880`083c8000 fffff880`083e1000   WudfPf     (deferred)
fffff960`00090000 fffff960`003a6000   win32k     (deferred)
fffff960`00500000 fffff960`0050a000   TSDDD      (deferred)
fffff960`00640000 fffff960`00667000   cdd        (deferred)
fffff960`00810000 fffff960`00871000   ATMFD      (deferred)

windbg local mode study

It will call dbgeng!LocalLiveKernelTargetInfo::InitDriver and then create kldbgdrv.sys in the c:\Windows\System32 folder.

Undocumented windbg command !chkallimg

!chkimg

The !chkimg extension detects corruption in the images of executable files by comparing them to the copy on a symbol store or other file repository.

!chkimg [Options] [-mmw LogFile LogOptions] [Module]

The !chkimg is useful for us to check the memory (code section) corruption problem.  But if you want to check all the images, you can use the command !chkallimg.  The weird thing is that it need to create the temp folder in the c:\ for !chkallimg command.

Windbg --Local Kernel Debugging

You can get more information here..http://msdn.microsoft.com/en-us/library/windows/hardware/ff553382(v=vs.85).aspx

You will see "bcdedit -debug on" error message.  Actually, you can use LiveKD to run windbg to solve this probem.

Difficulties in Performing Local Kernel Debugging

Local kernel debugging is a very delicate operation. Be careful that you do not corrupt or crash the system.

One of the most difficult aspects of local kernel debugging is that the machine state is constantly changing. Memory is paged in and out, the active process constantly changes, and virtual address contexts do not remain constant. However, under these conditions, you can effectively analyze things that change slowly, such as certain device states.

Kernel-mode drivers and the Windows operating system frequently send messages to the kernel debugger by using DbgPrint and related functions. These messages are not automatically displayed during local kernel debugging. You can display them by using the !dbgprint extension.

LiveKD

The LiveKD tool simulates local kernel debugging. This tool creates a "snapshot" dump file of the kernel memory, without actually stopping the kernel while this snapshot is made. (Therefore, the snapshot might not actually show a single instant state of the computer.)

LiveKD is not part of the Debugging Tools for Windows package. You can download LiveKd from the Windows Sysinternals site.

http://technet.microsoft.com/en-us/sysinternals/bb897415.aspx

PCI device extension

This show you the DeviceExtension of the PCI device object.

0: kd> !devobj 0xfffffa8002108a10
Device object (fffffa8002108a10) is for:
 NTPNP_PCI0022 \Driver\pci DriverObject fffffa80012201c0
Current Irp 00000000 RefCount 0 Type 00000023 Flags 00001840
Dacl fffff9a1092d5981 DevExt fffffa8002108b60 DevObjExt fffffa8002108f88 DevNode fffffa8002109990
ExtensionFlags (0000000000)
AttachedDevice (Upper) fffffa8002109e40 \Driver\ACPI
Device queue is not busy.
0: kd> dt nt!_device_object 0xfffffa8002108a10
   +0x000 Type             : 0n3
   +0x002 Size             : 0x578
   +0x004 ReferenceCount   : 0n0
   +0x008 DriverObject     : 0xfffffa80`012201c0 _DRIVER_OBJECT
   +0x010 NextDevice       : 0xfffffa80`02103910 _DEVICE_OBJECT
   +0x018 AttachedDevice   : 0xfffffa80`02109e40 _DEVICE_OBJECT
   +0x020 CurrentIrp       : (null)
   +0x028 Timer            : (null)
   +0x030 Flags            : 0x1840
   +0x034 Characteristics  : 0x100
   +0x038 Vpb              : (null)
   +0x040 DeviceExtension  : 0xfffffa80`02108b60 Void
   +0x048 DeviceType       : 0x23
   +0x04c StackSize        : 1 ''
   +0x050 Queue            : <unnamed-tag>
   +0x098 AlignmentRequirement : 0
   +0x0a0 DeviceQueue      : _KDEVICE_QUEUE
   +0x0c8 Dpc              : _KDPC
   +0x108 ActiveThreadCount : 0
   +0x110 SecurityDescriptor : 0xfffff8a0`092d5980 Void
   +0x118 DeviceLock       : _KEVENT
   +0x130 SectorSize       : 0
   +0x132 Spare1           : 1
   +0x138 DeviceObjectExtension : 0xfffffa80`02108f88 _DEVOBJ_EXTENSION
   +0x140 Reserved         : (null)
0: kd> dt pci!_PCI_DEVICE  0xfffffa80`02108b60 
   +0x000 Signature        : 0x44696350
   +0x004 DeviceState      : 0x1 ''
   +0x005 TentativeNextState : 0x1 ''
   +0x008 DeviceUsage      : _PCI_DEVICE_USAGE
   +0x014 BusNumber        : 1
   +0x018 Slot             : _PCI_SLOT_NUMBER
   +0x01c VendorID         : 0x1002
   +0x01e DeviceID         : 0x6840
   +0x020 RevisionID       : 0 ''
   +0x021 BaseClass        : 0x3 ''
   +0x022 SubClass         : 0 ''
   +0x023 ProgIf           : 0 ''
   +0x024 SubVendorID      : 0x1043
   +0x026 SubSystemID      : 0x10dc
   +0x028 HeaderType       : 0 ''
   +0x029 InterruptPin     : 0x1 ''
   +0x02a FirstCapability  : 0x50 'P'
   +0x02b PowerCapability  : 0x50 'P'
   +0x02c SubIDsCapability : 0 ''
   +0x02d AgpCapability    : 0 ''
   +0x02e PciXCapability   : 0 ''
   +0x02f MsiCapability    : 0xa0 ''
   +0x030 MsiXCapability   : 0 ''
   +0x031 FirstHtCapability : 0 ''
   +0x032 HtMsiMapCapability : 0 ''
   +0x033 ExpressCapability : 0x58 'X'
   +0x034 PossibleDecodes  : 4
   +0x036 ResourceDecodes  : 7
   +0x038 PreviousCommand  : 0
   +0x040 DeviceObject     : 0xfffffa80`02108a10 _DEVICE_OBJECT
   +0x048 Root             : 0xfffffa80`020cebb0 _PCI_ROOT
   +0x050 Parent           : 0xfffffa80`020fee00 _PCI_BUS
   +0x058 Sibling          : (null)
   +0x060 RemoveLock       : _IO_REMOVE_LOCK
   +0x080 ExpressCompatibilityPort : 0xfffffa80`020df850 _EXPRESS_COMPATIBILITY_PORT
   +0x088 ExpressPort      : (null)
   +0x090 HotPlugSlot      : (null)
   +0x098 InstanceIdSerialNumber : 0
   +0x0a0 Resources        : _PCI_DEVICE_RESOURCES
   +0x190 Requirements     : _PCI_DEVICE_REQUIREMENTS
   +0x310 InterruptResource : _PCI_DEVICE_INTERRUPT_RESOURCE
   +0x360 InterruptRequirement : _PCI_DEVICE_INTERRUPT_REQUIREMENT
   +0x3a8 SavedRegisters   : _PCI_SAVE_RESTORE_DATA
   +0x3b4 CapturedProcessorCount : 4
   +0x3b8 LogicalPowerState : 4 ( PowerDeviceD3 )
   +0x3bc WakeLevel        : 0 ( PowerDeviceUnspecified )
   +0x3c0 PowerSupport     : _PM_SUPPORT
   +0x3c8 WakeIrp          : (null)
   +0x3d0 WakeIrpState     : 0n0
   +0x3d8 WakeIrpLock      : 0
   +0x3e0 ConfigureMwi     : 0y0
   +0x3e0 BusNumbersConfigured : 0y0
   +0x3e0 OnDebugPath      : 0y0
   +0x3e0 MovedDeviceResources : 0y1
   +0x3e0 LegacyDriver     : 0y0
   +0x3e0 NativeIdeSwitchAllowed : 0y0
   +0x3e0 IdeInNativeMode  : 0y0
   +0x3e0 IdeInterfaceActive : 0y0
   +0x3e0 Present          : 0y1
   +0x3e0 ReportedMissing  : 0y0
   +0x3e0 Connected        : 0y1
   +0x3e0 PmeOwned         : 0y1
   +0x3e0 HyperTransport   : 0y0
   +0x3e0 MsiHtConverter   : 0y0
   +0x3e0 ExtendedConfigAvailable : 0y1
   +0x3e0 B2On66MHzSegmentIllegal : 0y0
   +0x3e0 Device66MHzCapable : 0y0
   +0x3e0 DsmToIgnoreBootConfigEvaluated : 0y1
   +0x3e0 IgnoreBootConfig : 0y0
   +0x3e0 Reserved         : 0y0000000000000 (0)
   +0x3e4 BridgeFlags      : <unnamed-tag>
   +0x3e8 HackFlags        : 0x20`00000002
   +0x3f0 Operations       : 0xfffff880`00e8d1c8 _PCI_HEADER_OPERATIONS
   +0x3f8 InterruptRoutingToken : ROUTING_TOKEN
   +0x408 PciBusInterfaceCount : 0n2
   +0x40c AgpTargetInterfaceRefCount : 0n0
   +0x410 PciCardBusInterfaceCount : 0n0
   +0x414 PciDevicePresentInterfaceCount : 0n1
   +0x418 PciNativeIdeInterfaceCount : 0n0
   +0x41c PciLocationInterfaceCount : 0n0
   +0x420 EnumFailureCode  : 0

Dump file analysis checklist

I just saw the dump file analysis checklist in the http://www.dumpanalysis.org/blog/index.php/2007/06/20/crash-dump-analysis-checklist/

There are some useful windbg commands in the web site.  Anyway, the dump file analysis need the experience and many test result for reference.

New debug features for Win 8

http://msdn.microsoft.com/en-us/library/hh451083(v=VS.85).aspx

New for Windows 8

[This documentation is preliminary and is subject to change.]

The following debugger features are new for Windows Developer Preview.

• Visual Studio Debugging Environment
• Debugging Over a Network Connection
• Debugging Over a USB 3.0 Connection
• Improved Debugging of Optimized Code and Inline Functions

The Windows Developer Preview Debugging Tools for Windows package does not support Windows 2000.

Sos.dll is a component that is used for debugging managed code. The Windows Developer Preview Debugging Tools for Windows package does not include any version of sos.dll. To get sos.dll for .NET Framework 1.x, download the Windows 7 Debugging Tools for Windowspackage. For later versions of .NET Framework , sos.dll is included in the .NET Framework installation.

Build date: 12/8/2011

Windbg --How to get the computer name

In the Windbg help file show us how to get the computer name.  The computer name is a unicode string in the srv!SrvComputerName.

There are two ways to show unicode..

dS	Specifies that a UNICODE_STRING structure is to be displayed.
du	Unicode characters          Each line displays up to 48 characters. The display continues until the first null byte or until all characters in range have been displayed. All nonprintable characters, such as carriage returns and line feeds,are displayed as periods (.).

For this case, it can use dS to show the computer name.

0: kd> dS srv!SrvComputerName

fffff8a0`0299aa60  "Y-SKU2-XX"

Note: 1. If the BSOD was happened during entering OS, maybe the srv.sys was not loaded yet.

          2. The srv.sys is the "Server driver"
          3. After try, the "!envvar COMPUTERNAME" command can't show the computer name.

Bug Check 0x9F: DRIVER_POWER_STATE_FAILURE

Windbg ver. 6.12.2.633 release note, we find some information how to diagnose bugcheck 9F.  

These information is also helpful and provide some directions when we try to check the BSOD 9F dump file.  

a) Bug Check 0x9F Update   Add logic to diagnose bugcheck 0x9F minidumps using new to Windows 7 data added to the 0x9F Mini Dumps by the Kernel and Networking Teams.

Data includes:

All Kernel ExWorkerThreads that process Power IRPs.

IRPs Associated with any ExWorkerThread

IRPs Associated with  PnP Completion Queue.  

All Kernel Power IRPs

Device Stacks for all IRPS

NT_TRIAGE_POWER Structure

NT_TRIAGE_PNP structure


BSOD 9F information in the http://msdn.microsoft.com/en-us/library/windows/hardware/ff559329(v=vs.85).asp

The most failures that we meet is the parameter1=3 condition.  Actually, we can know what device driver cause the BSOD  by parameter 2 and what power action cause the BSOD by parameter 4.

kd>!analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a time
Arg2: 857d6030, Physical Device Object of the stack
Arg3: 82b5dae0, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: 85086008, The blocked IRP

0: kd> dt nt!TRIAGE_9F_POWER 82b5dae0 
   +0x000 Signature        : 0x8000
   +0x002 Revision         : 1
   +0x004 IrpList          : 0x82b78480 _LIST_ENTRY
   +0x008 ThreadList       : 0x82b77f28 _LIST_ENTRY
   +0x00c DelayedWorkQueue : 0x82b715bc _TRIAGE_EX_WORK_QUEUE
The dt (Display Type) command displays the structure. You can use various debugger commands to follow the LIST_ENTRY fields to examine the list of outstanding IRPs and the power IRP worker threads. Use the !irp command to examine the IRP that was blocked. (The address of this IRP is in Parameter 4 (arg4).)

Here are also some suggestion in the website.

Use the !poaction command to display the threads that handle the power operations and any allocated power IRPs.

To help you determine the cause of the error, consider the following questions: Can you find the blocked thread? When you examine the thread with the !thread debugger command, what does the thread consist of? Is there IO associated with the thread that is blocking it? What symbols are on the stack? When you examine the blocked power IRP, what do you notice? What is the PnP minor function code of the power IRP? What are the characteristics of the physical device object (PDO) driver (Parameter 2, arg2)? Is it is a miniport driver?

parameter 1   parameter2        parameter3                                                   parameter4

0x3 (Windows XP and later)

The physical device object (PDO) of the stack

The functional device object (FDO) of the stack. In Windows 7, this parameter points to the nt!TRIAGE_9F_POWERstructure.

The blocked IRP

A device object has been blocking an IRP for too long a time.