User mode

!cs

Show the critical sections of the current process, or one critical section.

!cs [-l] [address]

Also: cs

Without an address, the command lists the sections ntdll keeps on RtlCriticalSectionList, each with whether a thread holds it, the owner’s thread ID, its recursion count, how many threads wait for it, and how often threads have waited; -l lists only the held ones. A section initialized without debug information (DebugInfo -1, as ntdll!FastPebLock is) is not on that list: give its address. The current process is the one that .process selected, else the owner of the current thread; on a user-mode minidump, its one process. Needs ntdll’s symbols.

!dlls

List the modules in the loader lists of the current process.

!dlls [-c <address>]

Also: dlls

The current process is the one that .process selected, else the owner of the current thread; on a user-mode minidump, its one process, as far as the dump captured the loader’s lists (lm lists the dump’s own module list). With -c

, the command shows only the module that contains that address. The module walk has a limit, and also stops if it finds a cycle in a list.

!gle

Show the last Win32 error value and the last NT status value of the current thread.

!gle

Also: gle

!heap

Summarize, walk, or search the user-mode heaps of the attached process, or of a user-mode minidump’s process.

!heap [-s]
!heap [-h|-a] <heap>
!heap -x <address>
!heap -p -a <address>

Also: heap

With no arguments or with -s, the command lists each heap of the process with its kind and sizes: the heaps on ntdll!RtlpProcessHeaps where ntdll keeps that list, else those in the PEB’s ProcessHeaps array. -h decodes the segments of one heap, and -a does the same and also lists each entry, chunk, and block. -x finds the block that contains an address, and -p -a does the same search. To identify a heap, use its index in that list or its address. The command decodes NT heaps, including legacy-LFH blocks, and segment heaps, including VS, LFH, page, and large allocations. It gets the encoding keys from ntdll symbols. For NT heaps, it uses _HEAP.Encoding and finds legacy-LFH blocks through their user block regions. For segment heaps, it uses the keys in ntdll!RtlpHpHeapGlobals. In a WOW64 process, the command shows the 32-bit heaps and decodes them with the layouts and keys of ntdll32.

!peb

Decode the process environment block and process parameters of the current process.

!peb [address]

Also: peb

If you do not give an address, the command uses EPROCESS.Peb of the current process: the one that .process selected, else the owner of the current thread. On a user-mode minidump it uses the PEB that the selected thread’s TEB names, and the layouts of the dump’s ntdll. It decodes the process parameters with their PDB layouts. To list the loader modules, use !dlls.

!runaway

Show how much processor time each thread of the current process has used.

!runaway [flags]

Also: runaway

The flags choose what to show, each as a list of the threads by that time, most first: 1 the user-mode time (the default), 2 the kernel-mode time, 4 the time since each thread started, so 7 shows all three. The current process is the one that .process selected, else the owner of the current thread; on a user-mode minidump, its one process, whose thread-info stream records the times. A kernel target counts them in clock ticks, so they are as precise as one tick (15.6 ms by default).

!teb

Decode a thread environment block.

!teb [address]

Also: teb

If you do not give an address, the command uses the teb pseudo-register of the current thread. On a user-mode minidump it uses the TEB of the selected thread (~s), and the layouts of the dump’s ntdll.