Execution and stack¶

!apc¶

List kernel and user APCs for the selected thread, process, or all threads.

!apc [process|thread]

Also: apc

With no argument the current Windows thread is used; * enumerates all threads within a bounded walk.

!stacks¶

Show every thread’s state, wait reason, and top stack symbol.

!stacks [0|1|2] [filter]

Also: stacks

Level 0 shows one frame; levels 1 and 2 append bounded full stacks. The optional filter matches process or stack symbols.

.cxr¶

Select a CONTEXT record, or reset the selected context.

.cxr [address]

.ecxr¶

Select the current exception context.

.ecxr

.exr¶

Display an EXCEPTION_RECORD64.

.exr <address|-1>

.frame¶

Select or display a stack frame.

.frame [/r] [N]

Also: frame

N is a zero-based frame number; /r also displays its recovered registers.

.thread¶

Switch the register and stack context to a Windows thread.

.thread [ethread|tid]

.trap¶

Decode and display a _KTRAP_FRAME (defaults to the current thread’s saved frame).

.trap [address-expression]

Also: trap

A trap frame names no process, so a user-mode frame resolves in the selected process; .trap warns when its address lies outside every module there. Select the owning thread or process first (.thread, .process /p).

.vtlcxr¶

Select the VTL0 context the Windows hypervisor saved for the vCPU halted in it.

.vtlcxr

For a vCPU stopped in the Windows hypervisor (VBS), reads what its virtual processor’s VTLs were doing from their Enlightened VMCS pages, lists them, and selects VTL0’s, so r, k, and u show where NT left off. The VM must expose hv-evmcs; the first use per boot scans host RAM for the pages. The context has RIP, RSP, flags, control, and segment registers, but no other general-purpose registers: the hypervisor keeps those in undocumented state. VTL1’s saved state is listed, not selected. .cxr resets. See ‘Where NT left off under the hypervisor’ in the VBS guide.

break¶

Break/pause VM execution.

break

g¶

Resume VM execution.

g [address]

Also: continue

An address runs to a temporary breakpoint: a debug-register one in secure-kernel code, never a patch there. The .vtl 1 memory view accepts only plain g, which leaves the view before resuming; stop in VTL1 with ba e1.

gh¶

Resume and mark the current exception handled.

gh [address]

gn¶

Resume and pass the current exception to Windows (KD only).

gn [address]

gu¶

Run until the current function returns.

gu or finish

Also: finish

kn¶

Display a stack; kp adds PDB parameter locations and kv provenance.

kn|k|kb|kp|kv [count]

Also: k, kb, kp, kv

p¶

Step over the current instruction.

p or ni

Also: ni

pa¶

Step over repeatedly until an address is reached.

pa <address>

pc¶

Step over until the next call instruction.

pc

ph¶

Step over until the next branch instruction.

ph

pt¶

Step over until the next return instruction.

pt

r¶

Display CPU registers or assign one register.

r [register[=expression]]

Also: registers

A 128-bit register (xmm0, ARM64 v0) displays at full width; assign its 64-bit halves (xmm0l/xmm0h, v0l/v0h). A vCPU stopped in VTL1 shows its VTL1 registers read-only; the .vtl 1 memory view has none.

t¶

Single step (step into).

Also: si

ta¶

Step into repeatedly until an address is reached.