Setting debugger target architecture: .effmach

Sometimes, you may find dumps with callstacks that point to the wow64 thunks with little else of value.  For example: 0:000> k # Child-SP RetAddr Call Site 00 00000000`0063e958 00000000`6c8d210d wow64cpu!<redacted>+0xc 01 00000000`0063e960 00000000`6c88bfa1 wow64cpu!<redacted>+0xc 02 (Inline Function) ——–`——– wow64!<redacted>+0xd 03 00000000`0063ea10 00000000`6c87cbb0 wow64!<redacted>+0xf311 04 00000000`0063ea90 00007ffd`d1ef2a11 wow64!<redacted>+0x120 05 00000000`0063ed40 00007ffd`d1f28986 ntdll!LdrpInitializeProcess+0x1551 06 00000000`0063f140 00007ffd`d1ed9fae ntdll!_LdrpInitialize+0x4e982 07…


Kd breakpoints don’t persist through reboot

Old nugget of information here, but useful to remember when the situation arises… When debugging in kd, a reboot will wipe out your breakpoints.  The break-in instruction gets replaced on OS reboot because everything is initializing from scratch, and the external debugger is not designed to be in the OS startup path.  I sometimes forget…