Target control

!dbgprint

Show guest debug output (DbgPrint).

!dbgprint [count]

Also: dbgprint

Shows the last count lines, 50 by default, or all with 0. Over kd and kdnet, it shows what the KD stream delivered since ntoseye attached, and before anything arrived, the kernel’s buffer. On the other backends, including a crash dump, it shows the kernel’s own DbgPrint buffer (KdPrintCircularBuffer), as WinDbg’s !dbgprint does, which also holds what was printed before ntoseye attached. The buffer is 4 KB by default and keeps only the newest output. A print that the debug filter drops (nt!Kd_DEFAULT_Mask, Kd__Mask) reaches neither.

.crash

Force a MANUALLY_INITIATED_CRASH (bugcheck 0xE2).

.crash

Also: crash

Windows first writes its crash dump, which often takes a minute, and the target ignores break-ins during this time. Then Windows reboots or, if automatic restart is disabled, breaks in. Ctrl+C stops the wait.

.dump

Write a full kernel dump of the halted target, or with /u a user-mode minidump of the current process.

.dump [/f] [/ma] [/u] <file>

Also: dump

Without /u, .dump writes a full PAGEDU64 kernel dump of a live target; it accepts /f and /ma as WinDbg’s full-dump switches. The dump holds each processor’s registers as NT sees them: a vCPU halted in the Windows hypervisor, or running VTL1, has the VTL0 state the hypervisor saved for it, when one is found. With /u, it writes a user-mode minidump (MDMP) of the current process: the one that .process selected, else the owner of the current thread. The minidump holds the process’s threads with the user-mode registers their stacks give, its modules with their CodeView records, its regions as VirtualQuery reports them, and every committed page of its memory that is in physical memory; a page in the page file is not in it. It works on a kernel dump too, and WinDbg and ntoseye –dump open it. .dump writes either file as a stream, and you can cancel it with Ctrl+C.

.kdfiles

Serve driver images from host files using a driver replacement map.

.kdfiles [map-file]
.kdfiles -m <target> <host>
.kdfiles -d <target>
.kdfiles -c

Without arguments, .kdfiles shows the mappings and serving statistics. A path loads a WinDbg map file of three-line records: map, the target name, and the host path. -m adds a mapping, -d removes one, and -c clears the map. Target names match case-insensitively on path suffix boundaries, and a bare filename matches any directory. Changes apply at the next driver load, so the guest can load a rebuilt driver without you copying it into the guest. See the driver replacement map guide.

.lastevent

Show the most recent target event that ntoseye observed.

.lastevent
.reboot

Reboot the debug target and reload its kernel context.

.reboot

Also: reboot, .restart, restart

ntoseye sends the reboot without confirmation, and handles the next KD state-change through the normal target-reload path.

.time

Show the target UTC time and the system uptime.

.time
capabilities

Show the backend capabilities.

capabilities
status

Show the current VM status.

status
vertarget

Show version information for the target, kernel, symbols, processor, and debugger.

vertarget

Also: version