Target control

!dbgprint

Show captured guest debug output (DbgPrint).

!dbgprint [count]

Also: dbgprint

.crash

Force a MANUALLY_INITIATED_CRASH (bugcheck 0xE2).

.crash

Also: crash

Windows writes its crash dump first (often a minute, during which the target ignores break-ins), then reboots or, with automatic restart disabled, breaks in. Ctrl+C stops waiting.

.dump

Write a full PAGEDU64 kernel dump from the halted target.

.dump [/f] [/ma] <file>

Also: dump

Both /f and /ma are accepted as WinDbg-compatible full-dump switches. The dump is streamed page by page and can be canceled with Ctrl+C.

.kdfiles

Serve driver images from host files using a driver replacement map.

.kdfiles [<map-file>] [-m <target> <host>] [-d <target>] [-c]

With no arguments, show mappings and serving statistics. A path loads a WinDbg map file containing three-line records of map, target name, and host path. -m adds a mapping, -d removes one, -c clears the map. Target names match case-insensitively on path suffix boundaries; a bare filename matches any directory. Changes take effect on the next driver load. A rebuilt driver thus loads without being copied into the guest. See the driver replacement map guide.

.lastevent

Show the most recently observed target event.

.lastevent

.reboot

Reboot the debug target and reload its kernel context.

.reboot

Also: reboot, .restart, restart

The reboot is sent without confirmation. The next KD state-change is handled by the normal target-reload path.

.time

Display target UTC time and system uptime.

.time

capabilities

Display backend capabilities.

capabilities

status

Display current VM status.

status

vertarget

Display target, kernel, symbol, processor, and debugger version information.

vertarget

Also: version