WinDbg
Jump to navigation
Jump to search
WinDbg
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/
WinGet
See WinGet
winget install Microsoft.WinDbg
Choco
WinDBG part of SDK now.
https://community.chocolatey.org/packages/windows-sdk-10-version-2004-windbg
choco install windows-sdk-10-version-2004-windbg
--
Obsolete - https://community.chocolatey.org/packages/windbg
- This package is unlisted and hidden from package listings.
- https://disq.us/url?url=https%3A%2F%2Fgithub.com%2Fpauby%2FChocoPackages%2Fblob%2Fmaster%2Funlisted%2Fwindbg%2FREADME.md%3APs42oYwEa_QThBLMO4cqVwlJETU&cuid=2163236
Memory Dump Options
System failure:
- [X] Write an event to the system log
- [ ] Automatically restart
Write debugging information:
- (none)
- Small memory dump (256 KB)
- Kernel memory dump
- Complete memory dump <-- much more details
- Automatic memory dump <-- default
- Active memory dump
Dump file:
%SystemRoot%\MEMORY.DMP
Others:
- [ ] Overwrite any existing file
- [ ] Disable automatic deletion of memroy dumps when disk space is...
-
Note there may also be a C:\Windows\Minidump\xxxxx-xxxx-xx.dmp
Debug Crash Dump
Sample: (caused by FTDI driver hang on system shutdown -- "IMAGE_NAME: ftdibus.sys")
Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\ci\windump\1307\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff803`7fe00000 PsLoadedModuleList = 0xfffff803`80a2a3b0
Debug session time: Tue Jul 22 09:24:54.965 2025 (UTC - 7:00)
System Uptime: 0 days 13:33:05.547
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
...........
For analysis of this file, run !analyze -v
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp
subsystem.
Arg2: 000000000000012c, Timeout in seconds.
Arg3: ffffc881c4ba0080, The thread currently holding on to the Pnp lock.
Arg4: ffff9a05b085f840, nt!TRIAGE_9F_PNP on Win7 and higher
Debugging Details:
------------------
Implicit thread is now ffffc881`c4ba0080
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on MYDEBUGSYSTEM
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 5
Key : Analysis.Memory.CommitPeak.Mb
Value: 71
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 9f
BUGCHECK_P1: 4
BUGCHECK_P2: 12c
BUGCHECK_P3: ffffc881c4ba0080
BUGCHECK_P4: ffff9a05b085f840
DRVPOWERSTATE_SUBCODE: 4
IMAGE_NAME: ftdibus.sys
MODULE_NAME: ftdibus
FAULTING_MODULE: fffff80389170000 ftdibus
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
STACK_TEXT:
ffff9a05`b085f808 fffff803`8030e256 : 00000000`0000009f 00000000`00000004 00000000`0000012c ffffc881`c4ba0080 : nt!KeBugCheckEx
ffff9a05`b085f810 fffff803`807b5726 : 00000000`00000000 00000000`00000001 00000000`00000080 ffff9e01`6ec82180 : nt!PnpBugcheckPowerTimeout+0x76
ffff9a05`b085f870 fffff803`8001fb32 : ffff9a05`b13d72f0 ffff9e01`6ec82180 ffff9a05`b085fad8 00000000`00000000 : nt!PopBuildDeviceNotifyListWatchdog+0x16
ffff9a05`b085f8a0 fffff803`8001ebad : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`001c65b4 : nt!KiProcessExpiredTimerList+0x172
ffff9a05`b085f990 fffff803`802028fe : ffffffff`00000000 ffff9e01`6ec82180 ffff9e01`6ec8d340 ffffc881`bfda60c0 : nt!KiRetireDpcList+0x5dd
ffff9a05`b085fc20 00000000`00000000 : ffff9a05`b0860000 ffff9a05`b0859000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: 0x9F_4_ftser2k_IMAGE_ftdibus.sys
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fb837d18-3623-9a52-7b65-9432338fa06c}
Followup: MachineOwner
---------