Category: Debugging

Lauterbach Basics Playlist

Lauterbach is a company that serves a niche-market of in-circuit emulators, especially on systems using JTAG, which it sells under the brand name TRACE32. Practice script is a file containing

Read More

Forcing Symbols to match in WinDbg

Use the Microsoft Symbol Server to obtain debug symbol files http://support.microsoft.com/kb/311503 other useful commands: !symfix .reload !analyze -v !sym noisy .symopt+ 0×40 .sympath SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols Sometimes we could have a

Read More

Setting Symbols in WinDbg

The symbol path specifies locations where the Windows debuggers (WinDbg, KD, CDB, NTST) look for symbol files. Microsoft OS symbols are located at: https://msdl.microsoft.com/download/symbols You can set the symbols in multiple

Read More

0x9F BugCheck with Param 3? Here is how you go about it

This post is for driver or kernel developers/enthusiasts who have encountered a Blue Screen of Death on Windows where the bugcheck code is 0x9F, DRIVER_POWER_STATE_FAILURE, and parameter 1 is 0x3.

Read More

Dumping a module’s memory space (via WinDbg)

The command .WRITEMEM allows us to save memory into a disk file. The cool thing about it is that we can save modules too, because they are just raw

Read More

User profile corruption in the registry [REGISTRY_ERROR (51)]

REGISTRY_ERROR (51) Something has gone badly wrong with the registry. If a kernel debugger is available, get a stack trace. It can also indicate that the registry got an

Read More

Stuck in the Apps Debug mode for a Kernal Crash dump?

  !wow64exts.sw Switches between x86 and native mode. I’d like to introduce you to how to switch to a kernal mode from a apps mode. This is how a

Read More

Creating a memory dump along with symbols using WinDbg

We can create a dump file from a running application or active driver crash using WinDbg. After the dump file is collected, it can be copied to another machine

Read More

Integer Divide by Zero leading to UNEXPECTED_KERNEL_MODE_TRAP (0x7f)

It is easily recognizable in process crash dumps by the processor instruction that caused this exception type (DIV or IDIV): FAULTING_IP: DLL!FindHighestID+278 1b2713c4 f775e4 div dword ptr [ebp-0×1c] EXCEPTION_RECORD:

Read More