Analysis

!analyze

Display a coherent first-pass crash triage report.

!analyze [-v] [-show <bugcheck-code> [p1 p2 p3 p4]] [-hang]

Also: analyze

Without -v prints the short verdict: bugcheck line, failure signature, culprit, verifier/WHEA findings, relevant modules. -v adds the full bugcheck arguments, faulting context, stack, and every module. -show decodes a bugcheck code without a crash; -hang triages per-processor waits.

!chkimg

Compare executable module sections with the cached on-disk image.

!chkimg [-d] [-v] [-nospec] <module>

Also: chkimg

Compares .text, PAGE*, and INIT executable sections after applying DIR64/HIGHLOW relocations. Discardable or paged-out sections are skipped. Known kernel self-patches (import optimization, retpoline, KiPatchSelf retargets) are counted separately unless -nospec is given, which drops that breakdown and reports them as ordinary mismatches. -d prints bounded byte diffs; -v prints per-section results.

!error

Decode an NTSTATUS, Win32, or HRESULT error code.

!error <code>

Also: !ntstatus

!verifier

Display Driver Verifier status, statistics, and verified drivers.

!verifier [module]

Also: verifier

Without a module, display the verifier level with its decoded options, the aggregate (global) counters, and the configured driver list: verified drivers from ViTargetDriversAvl plus configured-but-unloaded drivers from VfSuspectDriversList. With a module, display that driver’s verified-driver counters and image details: image, signing level, and load counts.