Processes and modules¶

!process¶

List or inspect Windows processes.

!process [eprocess|pid|0] [flags] [image-name]

!process 0 0 lists all processes; bit 1 adds process detail, bit 2 adds threads, and bit 4 adds each thread’s stack. ps retains its concise legacy listing.

!session¶

List sessions and the processes grouped into each session.

!session [-s <id>]

Also: session

Session IDs are read from _EPROCESS.Session and _MM_SESSION_SPACE, with a primary-token fallback when session space is opaque. Use -s -1 for the current session; the process walk is bounded to 4096 entries.

!sprocess¶

List processes in a session.

!sprocess [session] [flags] [image]

Also: sprocess

The session is signed decimal: -1 and -2 select the current session, and -4 all sessions. Without a session, the attached process’s session is selected when known. Flags default to 0 (brief); any non-zero value selects detailed output. The optional image argument is a case-insensitive glob.

!thread¶

Display a Windows thread and optionally its kernel stack.

!thread [ethread|tid] [flags] [count]

Also: thread

The legacy thread <tid> k|r [count] forms remain available. A numeric flags value selects detail/stack output; unavailable fields are shown as -.

!trustlets¶

List validated VTL1 processes with their NT identities and translation roots.

!trustlets

Reads SkpsProcessList through the secure kernel’s page tables. Each row shows the secure-kernel process object, NT PID and image name, trustlet ID, and address-space root. Unsupported internal layouts fail rather than guessing offsets. Does not switch scope.

!vad¶

Display a process’s VAD tree (defaults to the selected process context).

!vad [pid|eprocess]

Also: vmmap

Select a process by PID or EPROCESS expression; with no argument the current context is used (.process /p <pid> to select one). vmmap [address|filter] keeps the flat region view of the attached process, or the kernel modules when detached. VAD walks are bounded and skip unreadable entries rather than aborting the listing.

.context¶

Set the translation base used for inspection.

.context <dtb>

.effmach¶

Display or set the effective code machine.

.effmach [x86|amd64|auto|.]

With no argument, display the selected machine; x86 and amd64 override automatic code-bitness detection, while auto or . clears the override. x86 also makes ds/dS read 32-bit (WOW64) string descriptors.

.process¶

Select a process address space for inspection.

.process [/i] [/p] [/r] [eprocess|pid]

For this debugger /i is equivalent to attach; /p and /r select the same non-invasive context. With no argument, print the current process context.

.vtl¶

Select NT (VTL0) or secure-kernel (VTL1) memory inspection, or show which is active.

.vtl [0|1 [pid]]

VTL1 requires AMD64 direct host memory. .vtl 1 changes reads and symbol scope, not the CPU’s VTL. With no argument .vtl prints the current scope; .vtl 0 returns to the NT kernel, .vtl 1 selects the secure kernel’s system address space, and .vtl 1 <pid> a trustlet’s address space by its NT PID (always decimal). The VTL1 scope is a read-only memory view: registers, stepping, software breakpoints, writes, and NT-specific extensions need .vtl 0. To stop in VTL1, set a hardware execute breakpoint there (ba e1 securekernel!<function>, GDB backends) and resume with plain g, which returns to the live context first. A vCPU stopped in VTL1 shows its real registers, stack, and memory; with no argument .vtl reports whether reads follow such a live stop or the manual view.

attach¶

Attach to a process by PID.

attach <pid>

detach¶

Detach from current process.

detach

drivers¶

List driver objects from the \Driver object directory.

drivers [filter]

ld¶

Force symbol source selection and indexing for one module.

ld <module>

lm¶

List loaded modules.

lm [m <pattern>] [v] [u|k] [t]

m applies a module-name glob, v m prints verbose symbol information, u selects user modules, k selects kernel modules, and t adds timestamps.

lmv¶

Display detailed per-module symbol status and PDB identity.

lmv [module]

ps¶

List running processes.

ps [filter]

threads¶

List Windows threads, optionally filtered by process, PID, TID, or ETHREAD.

threads [filter]

vcpu¶

Switch to a different vCPU context.

vcpu <id>

~¶

List vCPU contexts and their RIP values.

Also: vcpus

A vCPU halted in the Windows hypervisor (VBS) also shows where its VTL0 left off, from the hypervisor’s saved state; .vtlcxr selects that context.