].Io.Handles
// Display all available information.
dx -g @$processHandles
// Displays selected information.
dx -g @$processHandles->Select(o => new { Handle = o->Handle, Type = o->Type, ObjectName = o->ObjectName})
// Filters handles of type "Directory" and displays selected information.
dx -g @$processHandles->Where(o => (o.Type == "Directory"))->Select(o => new { Handle = o->Handle, Type = o->Type, ObjectName = o->ObjectName})
// Get process Ldr first entry (in memory order).
dx -r1 @$process.Environment.EnvironmentBlock.Ldr->InMemoryOrderModuleList.Flink
```
**Execution control flow**
| Command | Usage | Examples | Description |
| ----------------------------------------------------------------------------------------------------------------------------- | ----- | -------- | ----------- |
| [bp, bu, bm (Set Breakpoint)](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bp--bu--bm--set-breakpoint-) | | | |
| [bl (Breakpoint List)](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bl--breakpoint-list-) | | | |
| [g (Go)](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/g--go-) | | | |
### Userland process crashdump / dump analysis
| Command | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `!analyze -v` | Provides an overview of the dump: process name, error code, stack trace, etc.
More useful for crashdump, limited use for voluntarily taken process dump.
|
| `!peb` | Parses the `Process Environment Block (PEB)` of the process, notably retrieving: the process image file and command line, current directory, loaded `DLLs`, windows title, environment variables. |
| `lm f` | Lists the loaded `DLLs`, with the possibility to click on any `DLL` to retrieve more information on a specific `DLL`: size, file / product version, metadata, etc. |
| `lmDv` | Prints verbose information (as mentioned on `lm f`) for all loaded `DLLs`. |
| `!address` | Lists the address pages and associated information:
- Page type (MEM\_IMAGE, MEM\_MAPPED, MEM\_PRIVATE)
- Page state (MEM\_COMMIT, MEM\_RESERVE, MEM\_FREE)
- Page protection (PAGE\_READWRITE, PAGE\_EXECUTE\_READ, PAGE\_EXECUTE\_READWRITE, etc.)
- Eventual associated file on disk
Can be useful to detect a number of suspicious indicators / anomalies:
- In memory PE (MZ header) not backed by an on-disk file.
- Suspicious PAGE\_EXECUTE\_READWRITE protection.
- Modification of modules usually patched to bypass security mechanism (such as the patching of the amsi.dll to bypass AMSI). Indeed a modification of a module memory will result in the page to change from MEM\_IMAGE to MEM\_PRIVATE.
|
| !address -f:\
Examples:
!address -f:PAGE\_EXECUTE\_READWRITE
!address -f:MEM\_PRIVATE,MEM\_COMMIT
| Filters memory pages based on the specified filter.
All filters in the list are AND-combined.
|
***
### References
* Microsoft Windows Debugging Tools official documentation
* "Modern Debugging with WinDbg Preview" DEFCON 27 workshop by hugsy and 0vercl0k"
* "WinDbg — the Fun Way: Part 1 / 2" by Yarden Shafir
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://notes.qazeer.io/miscellaneous/windbg_kernel.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.