1. Windows Debugging Demystified
Daniel Pearson
Product Support Services Microsoft Corporation

3. Overview Windows architecture What causes a bugcheck?
Causes of submitted bugchecks
Memory dump configuration
Analysis of memory dumps
Using Driver Verifier
Attaching a kernel debugger
Questions?

4. Windows Architecture System processes User applications
Windows services
Environment subsystems
Subsystem DLLs
User mode
Executive services
Windowing and graphics
Device drivers
Microkernel
Hardware Abstraction Layer (HAL)
Kernel mode

5. What Causes a Bugcheck?
A device driver or part of the operating system that incurs an unhandled exception
A device driver or part of the operating system that explicitly crashes the system due to an unrecoverable condition
A page fault that occurs at an interrupt request level of dispatch or higher
A hardware error such as a nonmaskable interrupt or faulty memory, disk, etc.

6. Causes of Submitted Bugchecks

7. Memory Dump Configuration
Small Memory Dump records the smallest set of useful information that will help identify why the system stopped unexpectedly
Kernel Memory Dump records only kernel memory, which speeds up the process of recording information in a log when the system stops unexpectedly
Complete Memory Dump records the entire contents of system memory when the system stops unexpectedly

9. Analysis of Memory Dumps
Debuggers available for download from
Configure the debugger to point to symbols
!analyze –v is a great start!

11. Using Driver Verifier Useful for identifying code defects in drivers
Performs more thorough checks on the system and device drivers as well as simulates failures
Built into the operating system

13. Attaching a Kernel Debugger
Useful for debugging initialization failures
Requires that the system be started with the debugger enabled to work
Support for using a null-modem, IEEE 1394 and USB 2.0 cable as well as virtual machines
Limited support for local kernel debugging

15. Resources http://www.microsoft.com/whdc

16. © 2007 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.