Windows windbg -- lm (List module)

For Windows 8.1 x64 OS, windbg lm command can list Windows module.  It help us to understand Windows driver image location.  There are 3 groups for the drivers.  kdcom.dll, ntoskrnl.exe, hal.dll is one group(FFFFF800xxxxxxxx).  win32k.sys, TSDDD.dll,cdd.dll, and ATMFD.dll is one group(FFFFF960xxxxxxxx).  The others is one group(FFFFF880xxxxxxxx).

0: kd> lm
start             end                 module name
fffff800`00bc3000 fffff800`00bcd000   kdcom      (deferred)
fffff800`02e03000 fffff800`033d4000   nt         (pdb symbols)         
fffff800`033d4000 fffff800`0341d000   hal        (deferred)
fffff880`00c00000 fffff880`00cc0000   CI         (deferred)
fffff880`00cd4000 fffff880`00ce1000   mcupdate_AuthenticAMD   (deferred)
fffff880`00ce1000 fffff880`00cf5000   PSHED      (deferred)
fffff880`00cf5000 fffff880`00d53000   CLFS       (deferred)
fffff880`00d53000 fffff880`00daf000   volmgrx    (deferred)
fffff880`00daf000 fffff880`00dd9000   ataport    (deferred)
fffff880`00dd9000 fffff880`00de4000   msahci     (deferred)
fffff880`00de4000 fffff880`00dfb000   amd_sata   (deferred)
fffff880`00e00000 fffff880`00e0a000   msisadrv   (deferred)
fffff880`00e0a000 fffff880`00e3d000   pci        (deferred)
fffff880`00e3d000 fffff880`00e4a000   vdrvroot   (deferred)
fffff880`00e4a000 fffff880`00e5f000   partmgr    (deferred)
fffff880`00e5f000 fffff880`00e68000   compbatt   (deferred)
fffff880`00e68000 fffff880`00e74000   BATTC      (deferred)
fffff880`00e74000 fffff880`00e89000   volmgr     (deferred)
fffff880`00e89000 fffff880`00e90000   pciide     (deferred)
fffff880`00e90000 fffff880`00ea0000   PCIIDEX    (deferred)
fffff880`00ea0000 fffff880`00eba000   mountmgr   (deferred)
fffff880`00eba000 fffff880`00ec3000   atapi      (deferred)
fffff880`00ec8000 fffff880`00f8a000   Wdf01000   (deferred)
fffff880`00f8a000 fffff880`00f9a000   WDFLDR     (deferred)
fffff880`00f9a000 fffff880`00ff1000   ACPI       (deferred)
fffff880`00ff1000 fffff880`00ffa000   WMILIB     (deferred)
fffff880`01025000 fffff880`01087000   storport   (deferred)
fffff880`01087000 fffff880`01094000   amd_xata   (deferred)
fffff880`01094000 fffff880`0109f000   amdxata    (deferred)
fffff880`0109f000 fffff880`010eb000   fltmgr     (deferred)
fffff880`010eb000 fffff880`0115c000   SYMDS64    (deferred)
fffff880`0115c000 fffff880`01170000   fileinfo   (deferred)
fffff880`01170000 fffff880`011bc000   volsnap    (deferred)
fffff880`011bc000 fffff880`011f6000   rdyboost   (deferred)
fffff880`01200000 fffff880`0125e000   msrpc      (deferred)
fffff880`0125e000 fffff880`012d0000   cng        (deferred)
fffff880`012f0000 fffff880`013d4000   SYMEFA64   (deferred)
fffff880`013d4000 fffff880`013e0040   PxHlpa64   (deferred)
fffff880`01400000 fffff880`0141a000   ksecdd     (deferred)
fffff880`0141a000 fffff880`0142b000   pcw        (deferred)
fffff880`0142b000 fffff880`01435000   Fs_Rec     (deferred)
fffff880`01453000 fffff880`015f4000   Ntfs       (deferred)
fffff880`01600000 fffff880`01649000   fwpkclnt   (deferred)
fffff880`0164b000 fffff880`0173d000   ndis       (deferred)
fffff880`0173d000 fffff880`0179d000   NETIO      (deferred)
fffff880`0179d000 fffff880`017c8000   ksecpkg    (deferred)
fffff880`017c8000 fffff880`017d0000   spldr      (deferred)
fffff880`017d0000 fffff880`017e2000   mup        (deferred)
fffff880`017e2000 fffff880`017eb000   hwpolicy   (deferred)
fffff880`01802000 fffff880`019ff000   tcpip      (deferred)
fffff880`01a27000 fffff880`01a61000   fvevol     (deferred)
fffff880`01a61000 fffff880`01a77000   disk       (deferred)
fffff880`01a77000 fffff880`01aa7000   CLASSPNP   (deferred)
fffff880`01ae9000 fffff880`01b13000   cdrom      (deferred)
fffff880`01b13000 fffff880`01b1c000   Null       (deferred)
fffff880`01b1c000 fffff880`01b23000   Beep       (deferred)
fffff880`01b23000 fffff880`01b33000   RegHiveRecovery   (deferred)
fffff880`01b33000 fffff880`01b41000   vga        (deferred)
fffff880`01b41000 fffff880`01b66000   VIDEOPRT   (deferred)
fffff880`01b66000 fffff880`01b76000   watchdog   (deferred)
fffff880`01b76000 fffff880`01b7f000   RDPCDD     (deferred)
fffff880`01b7f000 fffff880`01b88000   rdpencdd   (deferred)
fffff880`01b88000 fffff880`01b91000   rdprefmp   (deferred)
fffff880`01b91000 fffff880`01b9c000   Msfs       (deferred)
fffff880`01b9c000 fffff880`01bad000   Npfs       (deferred)
fffff880`01bad000 fffff880`01bcb000   tdx        (deferred)
fffff880`01bcb000 fffff880`01bd8000   TDI        (deferred)
fffff880`01bd8000 fffff880`01bf0000   BTHUSB     (deferred)
fffff880`03a00000 fffff880`03a20000   bthpan     (deferred)
fffff880`03a20000 fffff880`03a44e00   btath_rcp   (deferred)
fffff880`03a45000 fffff880`03aac000   btath_a2dp   (deferred)
fffff880`03ac8000 fffff880`03b54000   bthport    (deferred)
fffff880`03b54000 fffff880`03b65000   WinUSB     (deferred)
fffff880`03b65000 fffff880`03ba5000   RtsUStor   (deferred)
fffff880`03ba5000 fffff880`03bd1000   rfcomm     (deferred)
fffff880`03bd1000 fffff880`03be1000   BthEnum    (deferred)
fffff880`03c14000 fffff880`03c9d000   afd        (deferred)
fffff880`03c9d000 fffff880`03ce2000   netbt      (deferred)
fffff880`03ce2000 fffff880`03ceb000   wfplwf     (deferred)
fffff880`03ceb000 fffff880`03d11000   pacer      (deferred)
fffff880`03d11000 fffff880`03d27000   vwififlt   (deferred)
fffff880`03d27000 fffff880`03d36000   netbios    (deferred)
fffff880`03d36000 fffff880`03d51000   wanarp     (deferred)
fffff880`03d51000 fffff880`03d65000   termdd     (deferred)
fffff880`03d65000 fffff880`03dcc000   SYMNETS    (deferred)
fffff880`03dcc000 fffff880`03df9200   usbvideo   (deferred)
fffff880`03e00000 fffff880`03e76000   IDSVia64   (deferred)
fffff880`03e76000 fffff880`03e85000   discache   (deferred)
fffff880`03e85000 fffff880`03ea3000   dfsc       (deferred)
fffff880`03ea3000 fffff880`03eb4000   blbdrive   (deferred)
fffff880`03eb4000 fffff880`03ec7000   dump_dumpfve   (deferred)
fffff880`03ed5000 fffff880`03f0b000   SYMEVENT64x86   (deferred)
fffff880`03f0b000 fffff880`03f38000   Ironx64    (deferred)
fffff880`03f38000 fffff880`03f4e000   SRTSPX64   (deferred)
fffff880`03f4e000 fffff880`03f9f000   rdbss      (deferred)
fffff880`03f9f000 fffff880`03fab000   nsiproxy   (deferred)
fffff880`03fab000 fffff880`03fb6000   mssmbios   (deferred)
fffff880`03fb6000 fffff880`03fd3000   usbccgp    (deferred)
fffff880`03fd3000 fffff880`03ffdc40   CtClsFlt   (deferred)
fffff880`04000000 fffff880`0404f000   atikmpag   (deferred)
fffff880`0404f000 fffff880`04070000   raspptp    (deferred)
fffff880`04070000 fffff880`040b3000   ks         (deferred)
fffff880`040b3000 fffff880`040c5000   umbus      (deferred)
fffff880`040c5000 fffff880`041b0000   BHDrvx64   (deferred)
fffff880`041b0000 fffff880`041d6000   tunnel     (deferred)
fffff880`041d6000 fffff880`041ee000   amdhub30   (deferred)
fffff880`041ee000 fffff880`041fc000   monitor    (deferred)
fffff880`04200000 fffff880`0426a000   Rt64win7   (deferred)
fffff880`0426a000 fffff880`0428e000   rasl2tp    (deferred)
fffff880`0428e000 fffff880`04299000   btath_bus   (deferred)
fffff880`042a0000 fffff880`04394000   dxgkrnl    (deferred)
fffff880`04394000 fffff880`043da000   dxgmms1    (deferred)
fffff880`043da000 fffff880`043fe000   HDAudBus   (deferred)
fffff880`04a00000 fffff880`04a2f000   ndiswan    (deferred)
fffff880`04a2f000 fffff880`04a4a000   raspppoe   (deferred)
fffff880`04a4a000 fffff880`04a64000   rassstp    (deferred)
fffff880`04a65000 fffff880`0538c000   atikmdag   (deferred)
fffff880`0538c000 fffff880`053e6000   Apfiltr    (deferred)
fffff880`053e6000 fffff880`053fa000   amdiox64   (deferred)
fffff880`05600000 fffff880`056a6000   peauth     (deferred)
fffff880`056b9000 fffff880`0571c000   btath_hcrp   (deferred)
fffff880`0571c000 fffff880`0572b000   btath_flt   (deferred)
fffff880`0572b000 fffff880`0573e000   btath_lwflt   (deferred)
fffff880`0573e000 fffff880`05761000   luafv      (deferred)
fffff880`05761000 fffff880`05776000   lltdio     (deferred)
fffff880`05776000 fffff880`057c9000   nwifi      (deferred)
fffff880`057c9000 fffff880`057dc000   ndisuio    (deferred)
fffff880`057dc000 fffff880`057f4000   rspndr     (deferred)
fffff880`05800000 fffff880`05804500   CmBatt     (deferred)
fffff880`05805000 fffff880`0581a000   amdppm     (deferred)
fffff880`0581a000 fffff880`0582a000   CompositeBus   (deferred)
fffff880`0582a000 fffff880`05840000   AgileVpn   (deferred)
fffff880`05840000 fffff880`0584c000   ndistapi   (deferred)
fffff880`0584c000 fffff880`0584d480   swenum     (deferred)
fffff880`05851000 fffff880`05cdb000   bcmwl664   (deferred)
fffff880`05cdb000 fffff880`05ce8000   vwifibus   (deferred)
fffff880`05ce8000 fffff880`05d18000   amdxhc     (deferred)
fffff880`05d18000 fffff880`05d19f00   USBD       (deferred)
fffff880`05d1a000 fffff880`05d29000   usbfilter   (deferred)
fffff880`05d29000 fffff880`05d34000   usbohci    (deferred)
fffff880`05d34000 fffff880`05d8a000   USBPORT    (deferred)
fffff880`05d8a000 fffff880`05d9b000   usbehci    (deferred)
fffff880`05d9b000 fffff880`05db9000   i8042prt   (deferred)
fffff880`05db9000 fffff880`05dc8000   kbdclass   (deferred)
fffff880`05dc8000 fffff880`05dd7000   mouclass   (deferred)
fffff880`05dd7000 fffff880`05df7000   sdbus      (deferred)
fffff880`05df7000 fffff880`05e00000   wmiacpi    (deferred)
fffff880`05e00000 fffff880`05e0e000   hidusb     (deferred)
fffff880`05e0e000 fffff880`05e27000   HIDCLASS   (deferred)
fffff880`05e27000 fffff880`05e2f080   HIDPARSE   (deferred)
fffff880`05e30000 fffff880`05e3d000   mouhid     (deferred)
fffff880`05e3d000 fffff880`05e49000   Dxapi      (deferred)
fffff880`05e49000 fffff880`05e57000   crashdmp   (deferred)
fffff880`05e57000 fffff880`05e61000   dump_diskdump   (deferred)
fffff880`05e61000 fffff880`05e78000   dump_amd_sata   (deferred)
fffff880`05e82000 fffff880`05edc000   usbhub     (deferred)
fffff880`05edc000 fffff880`05ef1000   NDProxy    (deferred)
fffff880`05ef1000 fffff880`05f11000   AtihdW76   (deferred)
fffff880`05f11000 fffff880`05f4e000   portcls    (deferred)
fffff880`05f4e000 fffff880`05f70000   drmk       (deferred)
fffff880`05f70000 fffff880`05f75200   ksthunk    (deferred)
fffff880`05f76000 fffff880`05ff9000   stwrt64    (deferred)
fffff880`07623000 fffff880`076eb000   HTTP       (deferred)
fffff880`076eb000 fffff880`07709000   bowser     (deferred)
fffff880`07709000 fffff880`07721000   mpsdrv     (deferred)
fffff880`07721000 fffff880`0774e000   mrxsmb     (deferred)
fffff880`0774e000 fffff880`0779c000   mrxsmb10   (deferred)
fffff880`0779c000 fffff880`077bf000   mrxsmb20   (deferred)
fffff880`077bf000 fffff880`077d1000   tcpipreg   (deferred)
fffff880`07c00000 fffff880`07c0b000   secdrv     (deferred)
fffff880`07c0b000 fffff880`07c38000   srvnet     (deferred)
fffff880`07c41000 fffff880`07df6000   rikvm_9EC60124   (deferred)
fffff880`08200000 fffff880`08236000   fastfat    (deferred)
fffff880`08236000 fffff880`0825e000   mrxdav     (deferred)
fffff880`0825e000 fffff880`08294000   WUDFRd     (deferred)
fffff880`08294000 fffff880`082af000   USBSTOR    (deferred)
fffff880`082af000 fffff880`082bc000   LiveKdD    (deferred)
fffff880`082cc000 fffff880`08333000   srv2       (deferred)
fffff880`08333000 fffff880`083c8000   srv        (deferred)
fffff880`083c8000 fffff880`083e1000   WudfPf     (deferred)
fffff960`00090000 fffff960`003a6000   win32k     (deferred)
fffff960`00500000 fffff960`0050a000   TSDDD      (deferred)
fffff960`00640000 fffff960`00667000   cdd        (deferred)
fffff960`00810000 fffff960`00871000   ATMFD      (deferred)

Windbg: How to implement .frame command.

There is the windbg command .frame

.frame (Set Local Context)

The .frame command specifies which local context (scope) is used to interpret local variables or displays the current local context.

.frame [/c] [/r] [FrameNumber] 

There is the function in the dbgeng.dll can help us to implement it.

IDebugSymbols3::SetScopeFrameByIndex method

Undocumented windbg command !chkallimg

!chkimg

The !chkimg extension detects corruption in the images of executable files by comparing them to the copy on a symbol store or other file repository.

!chkimg [Options] [-mmw LogFile LogOptions] [Module]

The !chkimg is useful for us to check the memory (code section) corruption problem.  But if you want to check all the images, you can use the command !chkallimg.  The weird thing is that it need to create the temp folder in the c:\ for !chkallimg command.

object management -- !object

There are some information about the object management in the 

    1. Windows internals Chapter 3.  

    2. http://msdn.microsoft.com/en-us/library/windows/hardware/ff554383(v=vs.85).aspx.  

    3. http://www.codemachine.com/article_objectheader.html

The Windows Object Manager controls objects that are part of the kernel-mode operating system. An object is a collection of data that the operating system manages.

Kernel-mode objects can be referenced by pointers. An object may have an object name. For more information about object names, see Object Names.

User-mode programmers can reference objects only through indirection, using a handle. If an object has a name, you can use it to obtain the handle in user mode. For more information about handles, see Object Handles.

Kernel-mode objects have a very specific life-cycle. For more information about object life-cycles, see Life Cycle of an Object.

Object security is a prime concern for kernel-mode programming. For more information on object security, see Object Security.

There are two ways to investigate Windows Object.

1. WinObj.exe utility  in the http://technet.microsoft.com/en-us/sysinternals/bb896657

2. !object command in the windbg utility

How to implement !object

 Root Directory Object address: ObpRootDirectoryObject

//http://www.nirsoft.net/kernel_struct/vista/OBJECT_DIRECTORY.html

typedef struct _OBJECT_DIRECTORY
{
     POBJECT_DIRECTORY_ENTRY HashBuckets[37];
     EX_PUSH_LOCK Lock;
     PDEVICE_MAP DeviceMap;
     ULONG SessionId;
     PVOID NamespaceEntry;
     ULONG Flags;
} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;

typedef struct _OBJECT_DIRECTORY_ENTRY
{
     POBJECT_DIRECTORY_ENTRY ChainLink;
     PVOID Object;
     ULONG HashValue;
} OBJECT_DIRECTORY_ENTRY, *POBJECT_DIRECTORY_ENTRY;

typedef struct _OBJECT_HEADER_NAME_INFO
{
     POBJECT_DIRECTORY Directory;
     UNICODE_STRING Name;
     ULONG QueryReferences;
} OBJECT_HEADER_NAME_INFO, *POBJECT_HEADER_NAME_INFO;



0: kd> dq ObpRootDirectoryObject
fffff800`02e25790  fffff8a0`00005b40 fffffa80`03691c90
fffff800`02e257a0  fffffa80`03691de0 fffffa80`03691f30
fffff800`02e257b0  00000000`00000000 00000000`00000000
fffff800`02e257c0  fffffa80`03691f30 fffffa80`03691de0
fffff800`02e257d0  fffffa80`03691c90 fffffa80`03691980
fffff800`02e257e0  fffffa80`0368ba70 fffffa80`0368b920
fffff800`02e257f0  fffffa80`0368b7d0 fffffa80`0368b680
fffff800`02e25800  fffffa80`0368b530 fffffa80`0368b2e0
0: kd> dt _OBJECT_DIRECTORY 0xfffff8a0`00005b40 -b
nt!_OBJECT_DIRECTORY
   +0x000 HashBuckets      : 
    [00] (null) 
    [01] 0xfffff8a0`000059a0 
    [02] (null) 
    [03] (null) 
    [04] (null) 
    [05] 0xfffff8a0`001e11e0 
    [06] 0xfffff8a0`00278a90 
    [07] (null) 
    [08] 0xfffff8a0`0000be30 
    [09] 0xfffff8a0`000909f0 
    [10] 0xfffff8a0`00008bd0 
    [11] 0xfffff8a0`00276d00 
    [12] (null) 
    [13] 0xfffff8a0`06fbb8d0 
    [14] 0xfffff8a0`001bf6b0 
    [15] 0xfffff8a0`004cc250 
    [16] 0xfffff8a0`000086d0 
    [17] 0xfffff8a0`038221c0 
    [18] 0xfffff8a0`0000b390 
    [19] 0xfffff8a0`00105bb0 
    [20] 0xfffff8a0`00074cc0 
    [21] 0xfffff8a0`015213b0 
    [22] 0xfffff8a0`0381f1c0 
    [23] 0xfffff8a0`00005770 
    [24] (null) 
    [25] (null) 
    [26] 0xfffff8a0`00008450 
    [27] (null) 
    [28] 0xfffff8a0`0000a9a0 
    [29] 0xfffff8a0`01b3a830 
    [30] 0xfffff8a0`0000bc50 
    [31] (null) 
    [32] (null) 
    [33] (null) 
    [34] 0xfffff8a0`00274050 
    [35] (null) 
    [36] 0xfffff8a0`00073b00 
   +0x128 Lock             : _EX_PUSH_LOCK
      +0x000 Locked           : 0y0
      +0x000 Waiting          : 0y0
      +0x000 Waking           : 0y0
      +0x000 MultipleShared   : 0y0
      +0x000 Shared           : 0y000000000000000000000000000000000000000000000000000000000000 (0)
      +0x000 Value            : 0
      +0x000 Ptr              : (null) 
   +0x130 DeviceMap        : (null) 
   +0x138 SessionId        : 0xffffffff
   +0x140 NamespaceEntry   : (null) 
   +0x148 Flags            : 0

0: kd> dt _OBJECT_DIRECTORY_ENTRY 0xfffff8a0`000059a0 

nt!_OBJECT_DIRECTORY_ENTRY

   +0x000 ChainLink        : (null) 

   +0x008 Object           : 0xfffff8a0`00005560 Void

   +0x010 HashValue        : 0x6c1c47fb

0: kd> !object 0xfffff8a0`00005560

Object: fffff8a000005560  Type: (fffffa8003691de0) Directory

    ObjectHeader: fffff8a000005530 (new version)

    HandleCount: 0  PointerCount: 44

    Directory Object: fffff8a000005b40  Name: ObjectTypes

    Hash Address          Type          Name

    ---- -------          ----          ----

     00  fffffa8003721f30 Type          TmTm

     01  fffffa8003718660 Type          Desktop

         fffffa800368b920 Type          Process

     03  fffffa800368b2e0 Type          DebugObject

     04  fffffa800371f080 Type          TpWorkerFactory

     05  fffffa800371ff30 Type          Adapter

         fffffa8003691980 Type          Token

     08  fffffa8003711570 Type          EventPair

     09  fffffa800514a620 Type          PcwObject

         fffffa8003750350 Type          WmiGuid

     11  fffffa8003752350 Type          EtwRegistration

     12  fffffa8003724570 Type          Session

         fffffa8003718ba0 Type          Timer

     13  fffffa800370f270 Type          Mutant

     16  fffffa800371f9f0 Type          IoCompletion

     17  fffffa80037187b0 Type          WindowStation

         fffffa8003718a50 Type          Profile

     18  fffffa800371f8a0 Type          File

     21  fffffa8003718cf0 Type          Semaphore

     23  fffffa8003753350 Type          EtwConsumer

     25  fffffa8003721de0 Type          TmTx

         fffffa8003691c90 Type          SymbolicLink

     26  fffffa800372b660 Type          Key

         fffffa8003718900 Type          KeyedEvent

         fffffa800370f120 Type          Callback

         fffffa8005108a80 Type          FilterConnectionPort

     28  fffffa800368b680 Type          UserApcReserve

         fffffa800368ba70 Type          Job

     29  fffffa800371fde0 Type          Controller

         fffffa800368b530 Type          IoCompletionReserve

     30  fffffa800371fc90 Type          Device

         fffffa8003691de0 Type          Directory

     31  fffffa8003723570 Type          Section

         fffffa8003721b40 Type          TmEn

         fffffa800368b7d0 Type          Thread

     32  fffffa8003691f30 Type          Type

     33  fffffa8005108930 Type          FilterCommunicationPort

         fffffa8003731840 Type          PowerRequest

     35  fffffa8003721c90 Type          TmRm

         fffffa8003710570 Type          Event

     36  fffffa8003730ba0 Type          ALPC Port

         fffffa800371fb40 Type          Driver

!errlog

The !errlog extension displays the contents of any pending entries in the I/O system's error log.

Only entries that were queued by IoWriteErrorLogEntry but have not been committed to the error log will be displayed.

This command can be used as a diagnostic aid after a system crash because it reveals pending error information that was unable to be committed to the error log before the system halted.

nt!IoWriteErrorLogEntry+0x114:
fffff800`02d5de64 803d96b9110000  cmp     byte ptr [nt!IopErrorLogSessionPending (fffff800`02e79801)],0
fffff800`02d5de6b 488b05e6c21100  mov     rax,qword ptr [nt!IopErrorLogListHead+0x8 (fffff800`02e7a158)]
fffff800`02d5de72 488d4b08        lea     rcx,[rbx+8]
fffff800`02d5de76 48894310        mov     qword ptr [rbx+10h],rax
fffff800`02d5de7a 488d15cfc21100  lea     rdx,[nt!IopErrorLogListHead (fffff800`02e7a150)]
fffff800`02d5de81 488911          mov     qword ptr [rcx],rdx
fffff800`02d5de84 488908          mov     qword ptr [rax],rcx
fffff800`02d5de87 48890dcac21100  mov     qword ptr [nt!IopErrorLogListHead+0x8 (fffff800`02e7a158)],rcx
fffff800`02d5de8e 7533            jne     nt!IoWriteErrorLogEntry+0x173 (fffff800`02d5dec3)

IDebugDataSpaces::ReadDebuggerData

Index: DEBUG_DATA_IopErrorLogListHeadAddr  Returns the address of the kernel variable IopErrorLogListHead.

!vm --Physical memory

1: kd> !vm

*** Virtual Memory Usage ***

Physical Memory:      387422 (   1549688 Kb)

The physical memory size is the MmNumberOfPhysicalPages * (page size)

You can implement it using the dbgeng.dll

IDebugDataSpaces::ReadDebuggerData

The ReadDebuggerData method returns information about the target that the debugger engine has queried or determined during the current session. The available information includes the locations of certain key target kernel locations, specific status values, and a number of other things.

HRESULT ReadDebuggerData(
  [in]             ULONG Index,
  [out]            PVOID Buffer,
  [in]             ULONG BufferSize,
  [out, optional]  PULONG DataSize
);

DEBUG_DATA_MmNumberOfPhysicalPagesAddr

ULONG64

Returns the address of the kernel variableMmNumberOfPhysicalPages.




DEBUG_DATA_MmPageSize

ULONG64

Returns the page size.

!process -- Image name

PROCESS 852b8020  SessionId: 0  Cid: 1154    Peb: 7ffda000  ParentCid: 0ba4

    DirBase: ad036740  ObjectTable: b4061630  HandleCount:  53.

    Image: WerFault.exe

 From the _KPROCESS, it can't find the image name information, and it can be found in the _EPROCESS structure.

 

0: kd> dt _EPROCESS

nt!_EPROCESS

   +0x000 Pcb              : _KPROCESS

   +0x160 ProcessLock      : _EX_PUSH_LOCK

   +0x168 CreateTime       : _LARGE_INTEGER

   +0x170 ExitTime         : _LARGE_INTEGER

   +0x178 RundownProtect   : _EX_RUNDOWN_REF

   +0x180 UniqueProcessId  : Ptr64 Void

   +0x188 ActiveProcessLinks : _LIST_ENTRY

   +0x198 ProcessQuotaUsage : [2] Uint8B

   +0x1a8 ProcessQuotaPeak : [2] Uint8B

   +0x1b8 CommitCharge     : Uint8B

   +0x1c0 QuotaBlock       : Ptr64 _EPROCESS_QUOTA_BLOCK

   +0x1c8 CpuQuotaBlock    : Ptr64 _PS_CPU_QUOTA_BLOCK

   +0x1d0 PeakVirtualSize  : Uint8B

   +0x1d8 VirtualSize      : Uint8B

   +0x1e0 SessionProcessLinks : _LIST_ENTRY

   +0x1f0 DebugPort        : Ptr64 Void

   +0x1f8 ExceptionPortData : Ptr64 Void

   +0x1f8 ExceptionPortValue : Uint8B

   +0x1f8 ExceptionPortState : Pos 0, 3 Bits

   +0x200 ObjectTable      : Ptr64 _HANDLE_TABLE

   +0x208 Token            : _EX_FAST_REF

   +0x210 WorkingSetPage   : Uint8B

   +0x218 AddressCreationLock : _EX_PUSH_LOCK

   +0x220 RotateInProgress : Ptr64 _ETHREAD

   +0x228 ForkInProgress   : Ptr64 _ETHREAD

   +0x230 HardwareTrigger  : Uint8B

   +0x238 PhysicalVadRoot  : Ptr64 _MM_AVL_TABLE

   +0x240 CloneRoot        : Ptr64 Void

   +0x248 NumberOfPrivatePages : Uint8B

   +0x250 NumberOfLockedPages : Uint8B

   +0x258 Win32Process     : Ptr64 Void

   +0x260 Job              : Ptr64 _EJOB

   +0x268 SectionObject    : Ptr64 Void

   +0x270 SectionBaseAddress : Ptr64 Void

   +0x278 Cookie           : Uint4B

   +0x27c UmsScheduledThreads : Uint4B

   +0x280 WorkingSetWatch  : Ptr64 _PAGEFAULT_HISTORY

   +0x288 Win32WindowStation : Ptr64 Void

   +0x290 InheritedFromUniqueProcessId : Ptr64 Void

   +0x298 LdtInformation   : Ptr64 Void

   +0x2a0 Spare            : Ptr64 Void

   +0x2a8 ConsoleHostProcess : Uint8B

   +0x2b0 DeviceMap        : Ptr64 Void

   +0x2b8 EtwDataSource    : Ptr64 Void

   +0x2c0 FreeTebHint      : Ptr64 Void

   +0x2c8 FreeUmsTebHint   : Ptr64 Void

   +0x2d0 PageDirectoryPte : _HARDWARE_PTE

   +0x2d0 Filler           : Uint8B

   +0x2d8 Session          : Ptr64 Void

   +0x2e0 ImageFileName    : [15] UChar

Module information -- !lmi

0: kd> !lmi hpdskflt

Loaded Module Info: [hpdskflt] 

         Module: hpdskflt

   Base Address: fffffa6001a00000

     Image Name: hpdskflt.sys

   Machine Type: 34404 (X64)

     Time Stamp: 47e0334b Tue Mar 18 14:25:31 2008

           Size: a000

       CheckSum: e730

Characteristics: 22  

Debug Data Dirs: Type  Size     VA  Pointer

             CODEVIEW    55,  5220,    3a20 RSDS - GUID: {E531AC22-7E5E-4FC1-AB65-452496512564}

               Age: 30, Pdb: c:\prog\vendors\osr\hp3dgsr_vista\Release\amd64\hpdskflt.pdb

     Image Type: MEMORY   - Image read successfully from loaded memory.

    Symbol Type: NONE     - PDB not found from symbol server.

    Load Report: no symbols loaded

You can get more information in http://msdn.microsoft.com/en-us/library/windows/hardware/ff563955(v=vs.85).aspx.

The !lmi extension analyzes the module headers and displays a formatted summary of the information therein. If the module headers are paged out, an error message is displayed. To see a more extensive display of header information, use the !dh extension command.

You will need the PE and COFF knowledge for these two commands.  You can download the specification in the http://msdn.microsoft.com/library/windows/hardware/gg463125.

There is also a good website http://www.godevtool.com/Other/pdb.htm.

How to implement it?

IDebugSymbols::GetModuleParameters

then you will get the structure 

typedef struct _DEBUG_MODULE_PARAMETERS {
  ULONG64 Base;
  ULONG   Size;
  ULONG   TimeDateStamp;
  ULONG   Checksum;
  ULONG   Flags;
  ULONG   SymbolType;
  ULONG   ImageNameSize;
  ULONG   ModuleNameSize;
  ULONG   LoadedImageNameSize;
  ULONG   SymbolFileNameSize;
  ULONG   MappedImageNameSize;
  ULONG64 Reserved[2];
} DEBUG_MODULE_PARAMETERS, *PDEBUG_MODULE_PARAMETERS;

Module information

For windbg debug..You can use lm (list module) command  http://msdn.microsoft.com/en-us/library/windows/hardware/ff552026(v=vs.85).aspx

1: kd> lmvm nt

start             end                 module name

fffff800`02c49000 fffff800`03226000   nt         (export symbols)       ntkrnlmp.exe

    Loaded symbol image file: ntkrnlmp.exe

    Image path: ntkrnlmp.exe

    Image name: ntkrnlmp.exe

    Timestamp:        Mon Jul 13 16:40:48 2009 (4A5BC600)

    CheckSum:         0054B487

    ImageSize:        005DD000

    File version:     6.1.7600.16385

    Product version:  6.1.7600.16385

    File flags:       0 (Mask 3F)

    File OS:          40004 NT Win32

    File type:        1.0 App

    File date:        00000000.00000000

    Translations:     0409.04b0

    CompanyName:      Microsoft Corporation

    ProductName:      Microsoft® Windows® Operating System

    InternalName:     ntkrnlmp.exe

    OriginalFilename: ntkrnlmp.exe

    ProductVersion:   6.1.7600.16385

    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)

    FileDescription:  NT Kernel & System

    LegalCopyright:   © Microsoft Corporation. All rights reserved.

If you want to implement lmvm command by dbgeng.dll.  You can try GetModuleVersionInformation.

Status = g_Symbols->GetModuleByModuleName (name,0,&index, &base);

Status =  g_Symbols2->GetModuleVersionInformation (DEBUG_ANY_ID,base, 

"\\VarFileInfo\\Translation",   (LPVOID*)&lpTranslate, sizeof(LANGANDCODEPAGE), &size);

tmps.Format ("\\StringFileInfo\\%04x%04x\\CompanyName",lpTranslate.wLanguage,lpTranslate.wCodePage );

Status =  g_Symbols2->GetModuleVersionInformation (DEBUG_ANY_ID,base, tmps, buffer, 128, &size);

!amli lc

The !amli lc extension lists all active ACPI contexts.

 Ctxt=fffffa8001c87000, ThID=0000000000000000, Flgs=---C-----, pbOp=fffffa8001bfc229, Obj=\_SB.PCI0.VGA.ATCS

We can find the ACPI control method of VGA device is running...We can use !amli u to check more detail what ACPI code is running

1: kd> !amli u fffffa8001bfc225

AMLI_DBGERR: Failed to get address of ACPI!gDebugger

AMLI_DBGERR: Failed to get address of ACPI!gDebugger

fffffa8001bfc225 : Sleep(0x1e)

fffffa8001bfc229 : While(And(A008, Local1, AMLI_DBGERR: UnAsmSuperName: invalid SuperName - 0x0a

))

Windbg command tab completion

Here is some words copy from the Windbg help about the Tab completion.

Using Debugger Commands

You can press the TAB key to automatically complete your text entry. In any of the debuggers, press the TAB key after you enter at least one character to automatically complete a command. Press the TAB key repeatedly to cycle through text completion options, and hold down the SHIFT key and press TAB to cycle backward. You can also use wildcard characters in the text and press TAB to expand to the full set of text completion options. For example, if you type fo*!ba and then press TAB, the debugger expands to the set of all symbols that start with "ba", in all modules with module names that start with "fo". As another example, you can complete all extension commands that have "prcb" in them by typing !*prcb and then pressing TAB. 

When you use the TAB key to perform text completion, if your text fragment begins with a period (.), the text is matched to a dot command. If your text fragment begins with an exclamation point (!), the text is matched to an extension command. Otherwise, the text is matched with a symbol. When you usee the TAB key to enter symbols, pressing the TAB key completes code and type symbols and module names. If no module name is apparent, local symbols and module names are completed. If a module or module pattern is given, symbol completion completes code and type symbols from all matches.

This feature make us to type the windbg command faster.  And more useful for us is that can help us to find more Windbg commands.  When we type !po<tab>, we can find !poaction, then !pocaps..  You also can use !po*n<tab>.

There is another web site talk about this. http://analyze-v.com/?p=123

!devstack & !devnode

The !devstack extension displays a formatted view of the device stack associated with a device object.

The !devnode extension displays information about a node in the device tree.

1. WDM driver archecture is the layer structure.   

2. Each device function has a device node.

3. Device node is made by device objects.

1: kd> !devstack fffffa800201e830  (One of the device objects in the device node)  !DevObj   !DrvObj            !DevExt   ObjectName
  fffffa800201e4d0  \Driver\kbdclass   fffffa800201e620  KeyboardClass0
> fffffa800201e830  \Driver\i8042prt   fffffa800201e980    fffffa8001a8f060  \Driver\ACPI       fffffa8000c7b970  0000005e
!DevNode fffffa8001a90610 :
  DeviceInst is "ACPI\PNP0303\4&27dc0b59&0"
  ServiceName is "i8042prt"

1: kd> !DevNode fffffa8001a90610 1   (!devnode command can show us the device node information)DevNode 0xfffffa8001a90610 for PDO 0xfffffa8001a8f060
  InstancePath is "ACPI\PNP0303\4&27dc0b59&0"
  ServiceName is "i8042prt"
  TargetDeviceNotify List - f 0xfffff8a000c5cb70  b 0xfffff8a000c5cb70
  State = DeviceNodeStarted (0x308)
  Previous State = DeviceNodeEnumerateCompletion (0x30d)
1: kd> !devobj  fffffa8001a8f060 Device object (fffffa8001a8f060) is for:
 0000005e \Driver\ACPI DriverObject fffffa8000c394e0
Current Irp 00000000 RefCount 1 Type 00000032 Flags 00003040
Dacl fffff9a100094441 DevExt fffffa8000c7b970 DevObjExt fffffa8001a8f1b0 DevNode fffffa8001a90610
ExtensionFlags (0x00000800)
                             Unknown flags 0x00000800
AttachedDevice (Upper) fffffa800201e830 \Driver\i8042prtDevice queue is not busy.
1: kd> dt nt!_device_object fffffa8001a8f060
   +0x000 Type             : 3
   +0x002 Size             : 0x150
   +0x004 ReferenceCount   : 1
   +0x008 DriverObject     : 0xfffffa80`00c394e0 _DRIVER_OBJECT
   +0x010 NextDevice       : 0xfffffa80`01a52720 _DEVICE_OBJECT
   +0x018 AttachedDevice   : 0xfffffa80`0201e830 _DEVICE_OBJECT
   +0x020 CurrentIrp       : (null)
   +0x028 Timer            : (null)
   +0x030 Flags            : 0x3040
   +0x034 Characteristics  : 0x80
   +0x038 Vpb              : (null)
   +0x040 DeviceExtension  : 0xfffffa80`00c7b970     (The device extension is not the fixed structure)   +0x048 DeviceType       : 0x32
   +0x04c StackSize        : 5 ''
   +0x050 Queue            : <unnamed-tag>
   +0x098 AlignmentRequirement : 0
   +0x0a0 DeviceQueue      : _KDEVICE_QUEUE
   +0x0c8 Dpc              : _KDPC
   +0x108 ActiveThreadCount : 0
   +0x110 SecurityDescriptor : 0xfffff8a0`00094440
   +0x118 DeviceLock       : _KEVENT
   +0x130 SectorSize       : 0
   +0x132 Spare1           : 1
   +0x138 DeviceObjectExtension : 0xfffffa80`01a8f1b0 _DEVOBJ_EXTENSION
   +0x140 Reserved         : (null) 

1: kd> dt _DEVOBJ_EXTENSION 0xfffffa80`01a8f1b0  (Show the device object extension)nt!_DEVOBJ_EXTENSION

   +0x000 Type             : 13

   +0x002 Size             : 0

   +0x008 DeviceObject     : 0xfffffa80`01a8f060 _DEVICE_OBJECT

   +0x010 PowerFlags       : 0x10   (device/system power state information)    +0x018 Dope             : (null)

   +0x020 ExtensionFlags   : 0x800

   +0x028 DeviceNode       : 0xfffffa80`01a90610    +0x030 AttachedTo       : (null)    +0x038 StartIoCount     : 0

   +0x03c StartIoKey       : 0

   +0x040 StartIoFlags     : 0

   +0x048 Vpb              : (null)

   +0x050 DependentList    : _LIST_ENTRY [ 0xfffffa80`01a8f200 - 0xfffffa80`01a8f200 ]

   +0x060 ProviderList     : _LIST_ENTRY [ 0xfffffa80`01a8f210 - 0xfffffa80`01a8f210 ]

In the WIndbg !devnode xxxxxxxx 1 command, it will show show the InstancePath, ServiceName, State, PreviousState.

2: kd> dt _device_node
nt!_DEVICE_NODE
   +0x000 Sibling          : Ptr64 _DEVICE_NODE
   +0x008 Child            : Ptr64 _DEVICE_NODE
   +0x010 Parent           : Ptr64 _DEVICE_NODE
   +0x018 LastChild        : Ptr64 _DEVICE_NODE
   +0x020 PhysicalDeviceObject : Ptr64 _DEVICE_OBJECT
   +0x028 InstancePath     : _UNICODE_STRING
   +0x038 ServiceName      : _UNICODE_STRING
   +0x048 PendingIrp       : Ptr64 _IRP
   +0x050 Level            : Uint4B
   +0x058 Notify           : _PO_DEVICE_NOTIFY
   +0x0c0 PoIrpManager     : _PO_IRP_MANAGER
   +0x0e0 State            : _PNP_DEVNODE_STATE
   +0x0e4 PreviousState    : _PNP_DEVNODE_STATE
   +0x0e8 StateHistory     : [20] _PNP_DEVNODE_STATE
   +0x138 StateHistoryEntry : Uint4B
   +0x13c CompletionStatus : Int4B
   +0x140 Flags            : Uint4B
   +0x144 UserFlags        : Uint4B
   +0x148 Problem          : Uint4B
   +0x150 ResourceList     : Ptr64 _CM_RESOURCE_LIST
   +0x158 ResourceListTranslated : Ptr64 _CM_RESOURCE_LIST
   +0x160 DuplicatePDO     : Ptr64 _DEVICE_OBJECT
   +0x168 ResourceRequirements : Ptr64 _IO_RESOURCE_REQUIREMENTS_LIST
   +0x170 InterfaceType    : _INTERFACE_TYPE
   +0x174 BusNumber        : Uint4B
   +0x178 ChildInterfaceType : _INTERFACE_TYPE
   +0x17c ChildBusNumber   : Uint4B
   +0x180 ChildBusTypeIndex : Uint2B
   +0x182 RemovalPolicy    : UChar
   +0x183 HardwareRemovalPolicy : UChar
   +0x188 TargetDeviceNotify : _LIST_ENTRY
   +0x198 DeviceArbiterList : _LIST_ENTRY
   +0x1a8 DeviceTranslatorList : _LIST_ENTRY
   +0x1b8 NoTranslatorMask : Uint2B
   +0x1ba QueryTranslatorMask : Uint2B
   +0x1bc NoArbiterMask    : Uint2B
   +0x1be QueryArbiterMask : Uint2B
   +0x1c0 OverUsed1        : <unnamed-tag>
   +0x1c8 OverUsed2        : <unnamed-tag>
   +0x1d0 BootResources    : Ptr64 _CM_RESOURCE_LIST
   +0x1d8 BootResourcesTranslated : Ptr64 _CM_RESOURCE_LIST
   +0x1e0 CapabilityFlags  : Uint4B
   +0x1e8 DockInfo         : <unnamed-tag>
   +0x208 DisableableDepends : Uint4B
   +0x210 PendedSetInterfaceState : _LIST_ENTRY
   +0x220 LegacyBusListEntry : _LIST_ENTRY
   +0x230 DriverUnloadRetryCount : Uint4B
   +0x238 PreviousParent   : Ptr64 _DEVICE_NODE
   +0x240 DeletedChildren  : Uint4B
   +0x244 NumaNodeIndex    : Uint4B
   +0x248 ContainerID      : _GUID
   +0x258 OverrideFlags    : UChar
   +0x259 RequiresUnloadedDriver : UChar
   +0x260 PendingEjectRelations : Ptr64 _PENDING_RELATIONS_LIST_ENTRY

bp,bu,bm

Breakpoint type:

Breakpoints that are controlled by the processor at the request of the debugger are known as processor breakpoints or data breakpoints. Breakpoints that are controlled directly by the debugger are known as software breakpoints.

The bp, bu, and bm commands set one or more software breakpoints. You can combine locations, conditions, and options to set different kinds of software breakpoints. 

There are three primary differences between bp breakpoints and bu breakpoints:

• A bp breakpoint location is always converted to an address. If a module change moves the code at which a bp breakpoint was set, the breakpoint remains at the same address. On the other hand, a bu breakpoint remains associated with the symbolic value (typically a symbol plus an offset) that was used, and it tracks this symbolic location even if its address changes.
• If a bp breakpoint address is found in a loaded module, and if that module is later unloaded, the breakpoint is removed from the breakpoint list. On the other hand, bubreakpoints persist after repeated unloads and loads.
• Breakpoints that you set with bp are not saved in WinDbg workspaces. Breakpoints that are set with bu are saved in workspaces. 

The bm command is useful when you want to use wildcard characters in the symbol pattern for a breakpoint. The bm SymbolPattern syntax is equivalent to using xSymbolPattern and then using bu on each result. For example, to set breakpoints on all of the symbols in the Myprogram module that begin with the string "mem," use the following command.   It will need private symbol to perform bu command.

0:000> bm myprogram!mem* 
4: 0040d070 MyProgram!memcpy
5: 0040c560 MyProgram!memmove
6: 00408960 MyProgram!memset

The bp, bu, and bm commands set software breakpoints by replacing the processor instruction with a break instruction. To debug read-only code or code that cannot be changed, use a ba e command, where e represents execute-only access.

The bc command permanently removes previously set breakpoints from the system.
The bd command disables, but does not delete, previously set breakpoints.
The be command restores one or more breakpoints that were previously disabled.

1. Creates a "one-shot" breakpoint. After this breakpoint is triggered, it is deleted from the breakpoint list.

 bp /1 <address>

2. Specifies the number of the execution pass that the breakpoint is activated on.

        bp <address> Passes

3. It is possible to specify a data address rather than a program address when using the bp or bm /a commands.  if you are certain that the memory stored in that location will be used as executable code and not as program data. Otherwise, you should use the ba (Break on Access) command instead. For more details, see Processor Breakpoints (ba Breakpoints).