Debugger quick reference

As promised earlier, here’s a one page quick reference describing some of the most frequently used commands in cdb / ntsd / windbg / kd.

The debuggers themselves are available at and include reasonably good HTML Help documentation.  However, the one pager is nice for learning and reference, particularly if you don’t use these debuggers every day.

Send feedback if you find errors or have suggestions for improvements.

Comments (3)

  1. Pavel Lebedinsky says:

    Nice reference. Some comments:

    I prefer kP (with a capital P) as a way to dump stack+parameters (it prints each parameter nicely on a separate line).

    pc is a very useful stepping command (step to next function call).

    wt has some nice options such as (I think) -or for function return values.

    ~*Command syntax works only for a few commands such as k and r. The general form is ‘~*e [cmd]’ (execute [cmd] for each thread).

    Ns is probably a typo – should be ~Ns.

    .dump /f is deprecated. The minidump format is a superset of the old "full" dump format. To create the "fullest" dump possible, use .dump /ma

    Some other useful meta-commands and extensions:





    !token -n

    .sympath, .symfix, .reload and .srcpath – these are actually meta-commands (dot-commands), not extensions. The old "extension" syntax (!reload etc) is for backwards compatibility only.

    .server is the preferred way to do remoting It’s more flexible than .remote – you can use tcpip sockets for example.

  2. Pavel Lebedinsky says:

    Two more useful commands:

    x (examine symbols) – like x ntdll!*process*

    s (search memory)

    For the ‘s’ command it’s probably a good idea to mention the obscure syntax to search ranges larger than 256 MB. For example, s -d 0 l?20000000 12345678 will search the lower 2GB address space for 0x12345678.

  3. Great feedback, Pavel. I’ve made some fixes, tweaks, and added a few more commands.

    I’ll consider the others. So far the goal has been to keep it focused on the most frequently used commands.