User mode

!dlls

List modules from the attached process loader lists.

!dlls [-c <address>]

Also: dlls

The optional -c address limits the output to the module containing that address. Module traversal is bounded and cycle-safe.

!gle

Display the current thread’s last Win32 and NT status values.

!gle

Also: gle

!heap

Summarize, walk, or search the attached process’s user-mode heaps.

!heap [-s] [-h|-a <heap>] [-x <address>] [-p -a <address>]

Also: heap

Without arguments (or with -s) lists every heap in the PEB with its kind and sizes. -h decodes one heap’s segments; -a also lists every entry, chunk, and block. -x finds the block containing an address; -p -a is the same search. A heap is named by its index in the PEB list or its address. NT heaps (including legacy-LFH blocks) and segment heaps (VS, LFH, page, and large allocations) are decoded; ntdll symbols supply the encoding keys. NT heaps are decoded through _HEAP.Encoding, with legacy-LFH blocks resolved through their user block regions; segment heaps use the keys in ntdll!RtlpHpHeapGlobals. In a WOW64 process the heaps are the 32-bit ones, decoded with ntdll32’s layouts and keys.

!peb

Decode the attached process environment block and parameters.

!peb [address]

Also: peb

Without an address, uses the attached process’s EPROCESS.Peb. Process parameters are decoded from their PDB layouts; use !dlls to list loader modules.

!teb

Decode a thread environment block.

!teb [address]

Also: teb

Without an address, uses the current thread’s teb pseudo-register.