Training
Learning path
Use advance techniques in canvas apps to perform custom updates and optimization - Training
Use advance techniques in canvas apps to perform custom updates and optimization
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
This topic provides information on what's new in WinDbg. Earlier versions were released as WinDbg Preview.
We've fixed several issues when interacting with WinDbg using a screen reader.
We are now shipping a new backwards compatible JavaScript provider based on V8. As a result of this, arm64 hosts can now use JavaScript extensions. The arm64 UI also now defaults to the arm64 engine.
The new provider is enabled by default on all architectures.
On x86 and x64, it may be turned on/off via the .veighton
and .veightoff
commands.
At some point in the future, these commands and the legacy JavaScript provider will be removed.
Debugger extensions with extension gallery manifests can now add icons to the new Extensions tab of the WinDbg ribbon. Clicking these icons will trigger a visualization of a given data model query. This means of extensibility is accomplished by means of adding views to the extension gallery manifest. A view binds a coupling of a name and an icon to a data model query and view kind. Documentation can be found at Extension Gallery Manifest Documentation
A gallery extension can now be conditionally loaded based on specific exception parameter values. See Extension Gallery Manifest Documentation for details.
You can now skip downloading symbols for specified images.
In the Symbols
section of your DbgX.xml
configuration file, you can add a list of symbols:
<Namespace Name="DisabledSymbolsDownload">
<Setting Name="MSEdge.dll" Type="VT_BSTR" Value=""></Setting>
</Namespace>
In the debugger, you can run dx Debugger.Settings.Symbols.DisabledSymbolsDownload
to view the current list of symbols not being downloaded.
You can also change the list directly from the debugger like this:
dx @$curprocess.Modules[1].DisableSymbolDownload()
dx @$curprocess.Modules[1].EnableSymbolDownload()
To aid debugging issues with downloading sources based on embedded SourceLink, you can now use the command !lmsourcesinfo module
to display the contents of the SourceLink that the debugger will use.
We've made some small improvements to windows like the modules window or the stack window:
!address
that could cause a crash.!heap -a -a
should work now.See TTD Release Notes for version 1.11.410.
You can now live debug a Linux process. For more information, see these topics:
Linux live remote process debugging
The WinDbg client for the foreseeable future will still require Windows, as WinDbg does not run on Linux.
You can now specify a list of modules to record to focus TTD on the modules you care about. This can substantially reduce recording overhead. To use this simply check "Record subset of execution" in the "Configure and Record" dialog box, then specify the module(s) you want recorded. (see known issues below).
For finer control, you can precisely record your program using a new in-process recording API. See how with our sample code and documentation.
The new register window looks just like the output from the r
command. Note that editing from the new register window is not yet supported.
The e
(Enter Values) into memory commands now support physical addresses just like the d
(Display Memory) commands. Note these options are only supported in kernel mode:
Option | Description |
---|---|
/p |
Uses physical memory addresses for the display. The range specified by Range will be taken from physical memory rather than virtual memory. |
/p[c] |
Same as /p , except that cached memory will be read. The brackets around c must be included. |
/p[uc] |
Same as /p , except that uncached memory will be read. The brackets around uc must be included. |
/p[wc] |
Same as /p , except that write-combined memory will be read. The brackets around wc must be included. |
For more information, see e, ea, eb, ed, eD, ef, ep, eq, eu, ew, eza (Enter Values).
ForceMixedModeStackWalker
setting added to config.xml
or DbgX.xml
.!forceclrmixedmodeunwind
command for one-off investigations or if you can't change the config setting.!runq
command to LinuxKernel.js to be able to dump the per-cpu kernel scheduler run queues (similar in form to the Linux crash utility's runq
command)!lmsourcesinfo <module>
command to display sourcelink streams from pdb (to aid debugging issues with sourcelink).When specifying a list of modules to record with TTD, specifying more than one module doesn't work in this release.
Many bug fixes and small improvements.
Many bug fixes and small improvements.
Note
The debugger has been renamed from WinDbg Preview to WinDbg.
The legacy debugger released with Debugging Tools for Windows will be referenced as WinDbg (classic).
Not only does WinDbg run natively on ARM64, we also enabled Time Travel Debugging (TTD) of native ARM64 processes as well. You can now record native ARM64 processes (and x86 and ARM32 processes) and debug them easily, even on your x64 machine. Support for x64 or x64-enabled (ARM64EC) processes on ARM64 devices isn't yet available.
Overall TTD performance has also been improved, with recording overhead substantially reduced for processes that use common SIMD instructions. In total 65 new instructions were optimized, ranging from MMX through SSE 4.2, AVX and AVX2.
Ambiguous breakpoints allow for the debugger to set breakpoints in certain scenarios where a breakpoint expression resolves to multiple locations. For more information, see Ambiguous breakpoint resolution.
WinDbg Preview search now includes the option to search using regular expressions - Regex. Enable Regex in the window you'd like to search by doing Ctrl+F, then toggle the button labeled .*
next to the search box.
Restricted Mode is an optional setting that can limit the type of debugging sessions WinDbg Preview can start to remote debugging sessions and dump files only. For more information, see WinDbg - Restricted Mode.
In past versions, WinDbg throws "Ambiguous Symbol" errors when trying to evaluate (??) or display (dx) a variable that shares its name with another variable in scope. Windbg will now disambiguate variables that share the same name by appending @n
to the variable name. For example: foo@0
, foo@1
This change will also be reflected in the Locals window. Previously, only the nearest variable in scope would be displayed.
A convenient productivity feature of WinDbg Preview is the ability to detect patterns in the command window. To do this, select any text, and all other instances of that text highlighted. Because this highlighting is useful when looking at memory patterns, it now will also highlight equivalent numbers in other radixes, no matter how the number is formatted in hex, decimal, or scientific notation. For more information about numbering schemes, see n (Set Number Base).
Example:
When selecting 0x000001e2fb3f6160
, all other instances are highlighted no matter the format.
This feature works with semi-temporary highlights as well. Ctrl + Double Click on a number to highlight all its instances. You can keep track of multiple important numbers throughout your command history this way (to clear the highlight, Ctrl + Double Click on the number again). Finally, this feature also works when searching numbers with Ctrl + F.
The source path command .srcpath, .lsrcpath (Set Source Path) has been updated to include a new tag – DebugInfoD. For more information, see Source Code Extended Access.
When debugging a 32-bit WOW process from a 64-bit context, users can now access both the host and guest states within the data model.
32 bit guest state examples:
dx @$curprocess.Environment
dx @$curthread.Environment
dx @$curthread.Stack
64 bit host state examples:
dx @$curprocess.NativeEnvironment
dx @$curthread.NativeEnvironment
dx @$curthread.NativeStack
JavaScript loaded in the UI can now be directly debugged within the console using the .scriptdebug command. For more information, see JavaScript Debugger Scripting - JavaScript Debugging.
With WinDbg Preview we are committed to building a debugger that is inclusive to engineers with disabilities, we are continuously improving accessibility. The following improvements have been made.
Time Travel Debugger (TTD) now provides an “Overwrite” data access type. Memory queries such as dx @$cursession.TTD.Memory()
now have an additional column showing the old values of writes.
Timeline Bookmarks
Bookmark important Time Travel positions in WinDbg instead of manually copy pasting the position to notepad. Bookmarks make it easier to view at a glance different positions in the trace relative to other events, and to annotate them.
You can provide a descriptive name for bookmarks.
Access Bookmarks via the Timeline window available in View > Timeline. When you hover over a bookmark, it will display the bookmark name.
You can select and hold (or right-click) the bookmark to travel to that position, rename or delete the bookmark.
Modules Window
A new windows shows modules and their related information, it is available via the View ribbon. It displays:
Thread names/descriptions available in live debugging
Thread names that are set from SetThreadDescription are now available when doing live user-mode debugging. Thread names are available using the “~” command or the debugger data model.
0:000> ~
0 Id: 53a0.5ffc Suspend: 1 Teb: 000000b1`db1ed000 Unfrozen "Hello world!"
7 Id: 53a0.9114 Suspend: 1 Teb: 000000b1`db1ef000 Unfrozen
8 Id: 53a0.2cc4 Suspend: 1 Teb: 000000b1`db1f1000 Unfrozen
9 Id: 53a0.5c40 Suspend: 1 Teb: 000000b1`db1f3000 Unfrozen
0:000> dx @$curthread
@$curthread : ConsoleTestApp!ILT+25(mainCRTStartup) (00007ff7`fac7101e) [Switch To]
Id : 0x5ffc
Name : Hello world!
Stack
Registers
Environment
Portable PDB support
Portable PDB support has been added. The Portable PDB (Program Database) format describes an encoding of debugging information produced by compilers of Common Language Infrastructure (CLI) languages and consumed by debuggers and other tools. For more information, see Portable PDB Symbols.
Other changes and bug fixes
TTD Timelines - We've added a new window that displays a visual representation of important events in your trace: exceptions, breakpoints, function calls, and memory accesses. Timelines will automatically open and display exceptions (if present) and breakpoints. For more information, see WinDbg Preview - Timeline.
Switched to default window chrome - The custom window chrome we were using, while prettier, was causing some scaling and resizing issues for a notable number of people, so we’ve opted to remove it for the time being.
File menu improved keyboard navigation - The file menu is now much easier to navigate with just a keyboard.
Other changes and bug fixes
Improvements to TTD Calls objects - Calls queries now include parameter names, types, and values. When querying across traces for function calls you can get fully typed parameters and their values making it easy to filter down results by parameters.
Support for Open Enclave - WinDbg Preview can now debug Open Enclave (OE) applications for more information, see Open Enclave debugging).
ELF Core Dumps - As part of supporting Open Enclave, WinDbg can open ELF core dumps and binaries as well as DWARF symbols (DWARF 5 is not currently supported) from both Enclaves and Linux applications. When opening a core dump from a non-Windows application, basic windows and commands should all work properly, but most extensions and Windows-specific commands will not work. ELF and DWARF files will be downloaded from symbol servers following the key conventions defined here. Enclaves are the only supported scenario, but we’re open to feedback on opening other Linux core dumps.
TTD File format change - We’ve made a major update to the file format for TTD traces that breaks forward compatibility. Previous versions of WinDbg Preview will not be able to open traces recorded with this (and future) versions of WinDbg Preview, but this (and future) versions will be able to open both new and old traces.
Other changes
Improvements to SymSetDiaSession error mitigation - Our fix last month to mitigate the error caused by applications injecting DbgHelp into our process was still not working in some scenarios. We've made improvements to it and will continue to monitor feedback on this error.
Accent color customization - A lot of scenarios need several instances of WinDbg open, and moving back and forth between them can be confusing and take some time to figure out which one is the “right” one. We’ve added the ability to change the blue accent color to help visually distinguish sessions and make swapping between them easier.
Just select the View ribbon and select an option for Accent color in the last section. When future sessions are launched from recent targets, the accent color will be persisted as part of the target’s workspace.
Source tokenization improvements - The source window now has basic support for tokenizing Rust source files and C++ SEH __try/__except/__finally/__leave.
Coroutine improvements - Improved support for coroutine local variables and certain optimized variables.
Default symbol and source cache setting - Added an option to the settings menu under Debugging settings to change the cache location for symbols. Note - There’s a known issue that making this blank will cause source loading to fail. We’ll be adding validation to prevent this from happening in a future release.
-pv fixes - Fixed a bug that may have prevented -pv (non-invasive attach) from working in some circumstances.
Fix for SymSetDiaSession error - We've had reports for a while of an error that prevents WinDbg Preview from being launched in some situations. There are a few external applications that attempt to inject a version of DbgHelp into our process before we load it. Some of them are using a version of DbgHelp with missing functionality, which causes this error when we attempt to use those features. We've added a fix for this and will be tracking if there are still scenarios in which it occurs.
Font control - We've added settings for controlling font and font size. There are two different settings, one for text windows (mono-spaced windows like disassembly, source, command, etc.) and one for tool windows (locals, stack, etc.). There's still a few areas that aren't affected by these options that we'll be updating in the future.
Highlighting improvements - Persistent highlighting of text in the command window will now also highlight text in the source and notes windows.
Source loading improvements - We've changed how loading source files works. Previously when opening a source file, engine operations like running additional commands weren't possible or were unpredictable. We've changed where the loading occurs to enable better parallelism and more reliable cancellation of source opening operations.
Other changes and bug fixes:
This version includes these updates.
Debugger data model C++ header - There is a new C++ header, DbgModel.h, included as part of the Windows SDK for extending the debugger data model via C++. You can find more information in Debugger Data Model C++ Overview. This release includes a new extension that adds some more "API style" features to the debugger data model that can be accessed through the 'dx' command, JavaScript, and the new DbgModel.h header. This extension extensions the data model to include knowledge about assembly and code execution through the Debugger.Utility.Code namespace, and the local file system through the Debugger.Utility.FileSystem namespace.
Synthetic types extension With this new API extension, we have a new sample up on our GitHub repo here - https://github.com/Microsoft/WinDbg-Samples/tree/master/SyntheticTypes. This JavaScript extension reads basic C header files and defines synthetic type information for the structures and unions defined in the header. Through the dx command, memory can then be viewed structured as if you had a PDB with type information for those types.
Other changes and bug fixes:
This version includes these updates.
Other changes and bug fixes:
This version includes these updates.
Automatic saving and loading of breakpoints. This is a first step to replace workspaces. We’re starting down that route by enabling the saving and loading of breakpoints. Launching something you’ve debugged previously from the “Recents” tab in the file menu will now load the breakpoints from that session. The plan is to expand this functionality to preserve more information across sessions. Hardware breakpoints (ba) and other various properties on breakpoints like thread and process specific contexts as well as conditions are not currently being saved.
Minor changes and bug fixes:
This version includes these updates.
New disassembly window - The disassembly window now includes:
Faster source window - The source window has been updated to be faster and more resource efficient.
Minor changes and bug fixes:
This version includes these updates.
Symbol status and cancellation improvements - There are time where the debugger display BUSY loading symbols and it’s difficult to determine what it’s doing and why without !sym noisy enabled. We’ve updated WinDbg Preview to have some better communication around what it’s doing when loading symbols to help troubleshoot any issues. In addition to easily seeing exactly what’s happening, we’ve made some changes that should make cancelling symbols more reliable and the Logs window will contain some of the details that’s normally output when !sym noisy is enabled. If you hit View -> Logs you’ll get the full noisy symbol loading output without having to turn it on and attempt to reload the symbols.
Experimental notes window - WinDbg Preview now has a window for taking notes. Just hit View -> “Notes” to open it. If you copy/paste into it, DML links will be preserved and still work as if it was the command window. You can also save and load notes files from the “Notes” ribbon when the window is open.
Experimental faster source window - To help improve the performance of WinDbg Preview there is an experimental new source window that is quite a bit more efficient. There’s still a few gaps around context menus and syntax highlighting, but we want to give everyone the option of trying it out before it’s finished to give us early feedback. Run $UseFastSourceWindow to use it. If you want to go back to the old one, run $UseMonacoSourceWindow. The setting will preserve across sessions, you will need to close and re-open source windows to get the new version.
JSProvider API version 1.2 - For JavaScript extensions that declare support for API version 1.2:
Minor changes and bug fixes:
dx @$cursession.TTD.AsyncQueryEnabled = 1
to enable it.This version includes these updates.
Text Highlighting - You can now highlight all instances of selected text directly in the debugger. To use this feature, just select some text in the command window and then select “Highlight” in the command ribbon or hit CTRL+ALT+H. Using one of those on already highlighted text will remove the highlighting.
If you prefer using commands, you can use the “$hl” command:
$hl ["someValueHere"]
- Highlight give text (or un-highlight if already highlighted)
$hl clearAll
– Clear all highlighted entries
$hl caseSensitive [1|0]
- Set highlight matching to case sensitive or case insensitive (default is case insensitive)
This release also includes some minor bug fixes.
This version includes these updates.
TTD memory queries - You can now query TTD for memory accesses similar to how you query for calls today. This allows you to find all of the reads, writes and execution which access a specific range of memory.
Read and write example: dx @$cursession.TTD.Memory(startAddress, endAddress, "rw")
Unique execution example: dx @$cursession.TTD.Memory(startAddress, endAddress, "ec")
Settings changes - WinDbg Preview will now automatically save settings between sessions, including your symbol path and source path.
JavaScript Improvements
Minor changes and bug fixes:
This version includes these updates.
Improved process server experience - A new notification in the File menu to show what process server you’re connected to and interacting with has been added. As part of these changes, when ending a debugging session, the process server connection will persist and can be disconnected in the File menu.
New pre-set layout options in the View ribbon - There is a new “Layouts” option in the “View” ribbon. There are currently three layouts: the default, one focused on disassembly, and one minimal.
Time Travel Debugging ribbon - There is an enhanced Time Travel ribbon that will show up when debugging a time travel debugging trace.
Metadata from JavaScript scripts - JavaScript extensions can now return metadata for properties and other constructs. This means that the extension can provide help strings, indicate the display radix for values, and more. Metadata is provided by placing a metadata descriptor on an object via either presence of Symbol.metadataDescriptor or an explicit call to host.metadata.defineMetadata. Function returns, iterated values, and other value contexts can return metadata for their value via host.metadata.valueWithMetadata.
JavaScript API updates - Some potentially source level breaking changes were made to the APIs within the JavaScript provider (including new projected methods and properties on native objects). Existing extensions will not see any of the potentially breaking changes without indicating that they support a new version of the JsProvider API. Support for the new API version is indicated by placing a host.apiVersionSupport record in the array returned by initializeScript with a claim of supporting version 1.1. maybe? .. with a value indicating support for version 1.1.
Changes in API version 1.1 include:
Additional JavaScript changes
Minor changes and bug fixes:
Known issues:
This version adds Time Travel Tracing. Time Travel Debugging, allows you to record a process, then replay it later both forwards and backwards. Time Travel Debugging (TTD) can help you debug issues easier by letting you "rewind" your debugger session, instead of having to reproduce the issue until you find the bug. For more information, see Time Travel Debugging - Overview.
This version was the first release of WinDbg Preview. For general information on the features available in WinDbg Preview, Major Features of WinDbg.
Training
Learning path
Use advance techniques in canvas apps to perform custom updates and optimization - Training
Use advance techniques in canvas apps to perform custom updates and optimization
Documentation
WinDbg Overview - Windows drivers
This section is an overview of WinDbg's major features.
WinDbg - Start a user mode session - Windows drivers
This section describes how to start a user mode session with the WinDbg debugger.
WinDbg - Command line startup options - Windows drivers
This section covers the command line startup options for the WinDbg debugger.