Windows Debugging Demystified Daniel Pearson Product Support Services Microsoft Corporation

Overview Windows architecture What causes a bugcheck? Causes of submitted bugchecks Memory dump configuration Analysis of memory dumps Using Driver Verifier Attaching a kernel debugger Questions?

Windows Architecture System processes User applications Windows services Environment subsystems Subsystem DLLs User mode Executive services Windowing and graphics Device drivers Microkernel Hardware Abstraction Layer (HAL) Kernel mode

What Causes a Bugcheck? A device driver or part of the operating system that incurs an unhandled exception A device driver or part of the operating system that explicitly crashes the system due to an unrecoverable condition A page fault that occurs at an interrupt request level of dispatch or higher A hardware error such as a nonmaskable interrupt or faulty memory, disk, etc.

Causes of Submitted Bugchecks

Memory Dump Configuration Small Memory Dump records the smallest set of useful information that will help identify why the system stopped unexpectedly Kernel Memory Dump records only kernel memory, which speeds up the process of recording information in a log when the system stops unexpectedly Complete Memory Dump records the entire contents of system memory when the system stops unexpectedly

Analysis of Memory Dumps Debuggers available for download from http://www.microsoft.com/whdc Configure the debugger to point to symbols http://msdl.microsoft.com/download/symbols !analyze –v is a great start!

Using Driver Verifier Useful for identifying code defects in drivers Performs more thorough checks on the system and device drivers as well as simulates failures Built into the operating system

Attaching a Kernel Debugger Useful for debugging initialization failures Requires that the system be started with the debugger enabled to work Support for using a null-modem, IEEE 1394 and USB 2.0 cable as well as virtual machines Limited support for local kernel debugging

Resources http://www.microsoft.com/whdc http://msdn.microsoft.com/library http://oca.microsoft.com

© 2007 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.