WinDbg / SOS Cheat Sheet

March 14, 2006 · 2 min read

Here are the WinDbg / SOS commands I talked about at Code Camp NY.  These are the basic commands to get you going with WinDbg / SOS.

Starting, Attaching, Executing and Exiting

Start -> All Programs -> Debugging Tools for Windows -> WinDbg

F6

attach to process

Ctrl-Break

interrupt debugee

.detach

detach from a process

g

continue debugee execution

q

exit WinDbg

Getting Help

?

help on commands that affect the debugee

.help

help on commands that affect the debugger

.hh command

view the on line help file

!help

help on the extension dll at the top of the chain (e. g., SOS)

Issuing Commands

up arrow, down arrow, enter

scroll through command history

Right mouse button

paste into command window

Examining the Unmanaged Environment

lmf

list loaded modules with full path

lmt

list loaded modules with last modified timestamp

~

list unmanaged threads

~thread s

select a thread for thread specific commands

!token -n

view thread permissions

k

view the unmanaged call stack

!runaway

view thread CPU consumption

bp

set a breakpoint

.dump path

dump small memory image

.dump /ma path

dump complete memory image

Working with Extension DLLs (e. g., SOS)

.chain

list extensions dlls

.load clr10\sos

load SOS for debugging framework 1.0 / 1.1

.unload clr10\sos

unload SOS

.loadby sos mscorwks

load SOS for debugging framework 2.0

SOS Commands

!threads

view managed threads

!clrstack

view the managed call stack

!dumpstack

view combined unmanaged & managed call stack

!clrstack -p

view function call arguments

!clrstack –l

view stack (local) variables

!name2ee module class

view addresses associated with a class or method

!dumpmt –md address

view the method table & methods for a class

!dumpmd address

view detailed information about a method

!do address

view information about an object

!dumpheap –stat

view memory consumption by type

!dumpheap –min size

view memory consumption by object when at least size

!dumpheap –type type

view memory consumption for all objects of type type

!gcroot address

view which object are holding a reference to address

!syncblk

view information about managed locks

SOS 2.0 Commands

!bpmd module method

set breakpoint

!DumpArray address

view contents of an array

!PrintException

view information about most recent exception

This article is part of the GWB Archives. Original Author: David Douglass

New on Geeks with Blogs

  • We Won The One Award I Actually Care About

    Full Scale made the Inc. 5000 for the fifth year straight, the 12th listing across my three companies. Here is why the one award you cannot buy is worth stopping for.

  • Your Customers Build the Features Now

    I let a tool I liked sit dead for a year rather than build the features I wanted. An MCP server meant I never had to, and your customers can do the same to your product.

  • Get the Size of a Directory in Linux the Easy Way

    du -sh for the quick answer, ncdu for the cleanup, df for the disk itself: every command for checking directory size in Linux, plus why du and df never agree.

  • Vim Search and Replace: The Ultimate Guide

    One :%s command replaces every match in a file before a find dialog would even open. The Vim substitute patterns worth the muscle memory: flags, ranges, capture groups, and multi-file edits.