The Curious Engineer

All blogs / Windows internals

Ntdebugging Blog

learn.microsoft.com/en-us/archive/blogs/ntdebugging

Microsoft Advanced Windows Debugging and Troubleshooting - Contributions to this blog are made by the Microsoft Global Business Support - Windows Serviceability team.

Windows internalsOS / kernelReverse engineeringPerformance / optimizationMicrosoft blogsMSDN archive

’10’15’20’25
Posts
199 from 15 Dec 2006 to 4 Nov 2015
Posting
archived, read-only
Kind
company blog
Feed
https://learn.microsoft.com/en-us/archive/blogs/ntdebugging/feed.xml

2015 4

  1. When Special Pool is not so Special
  2. We Are Hiring – North Carolina and Texas
  3. Uncover the mystery of a bugcheck 0x24 (NTFS_FILE_SYSTEM)
  4. We Are Hiring Windows Escalation Engineers in Munich, Germany

2014 9

  1. Disk Performance Internals
  2. Driver Object Corruption Triggers Bugcheck 109
  3. How to identify a driver that calls a Windows API leading to a pool leak on behalf of NT Kernel?
  4. Windows Troubleshooting – Stop 9E Explained
  5. Windows Troubleshooting – Special Pool
  6. Bugchecking a Computer on A Usermode Application Crash
  7. Understanding ARM Assembly Part 3
  8. Understanding ARM Assembly Part 2
  9. NTFS Misreports Free Space (Part 3)

2013 18

  1. Understanding Pool Corruption Part 3 – Special Pool for Double Frees
  2. Event ID 157 "Disk # has been surprise removed"
  3. Understanding ARM Assembly Part 1
  4. The Compiler Did What?
  5. Debugging a Generation 2 Virtual Machine
  6. Performance Monitor Averages, the Right Way and the Wrong Way
  7. Missing System Writer Case Explained
  8. Understanding Pool Corruption Part 2 – Special Pool for Buffer Overruns
  9. Understanding Pool Corruption Part 1 – Buffer Overflows
  10. Another Who Done It
  11. Remoting Your Debug Crash Cart With KDNET
  12. Interpreting Event 153 Errors
  13. Commitment Failures, Not Just a Failed Love Story
  14. Understanding File System Minifilter and Legacy Filter Load Order
  15. Don't Believe Everything You Read
  16. Debugging a Debugger to Debug a Dump
  17. How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining
  18. Case of the Unexplained Services exe Termination

2012 21

  1. Use Caution When Implementing IPC for Performance Counters
  2. Determining the source of Bug Check 0x133 (DPC_WATCHDOG_VIOLATION) errors on Windows Server 2012
  3. Troubleshooting Pool Leaks Part 7 – Windows Performance Toolkit
  4. Troubleshooting Pool Leaks Part 6 – Driver Verifier
  5. Breaking down the "Cl" in !irp
  6. Troubleshooting Pool Leaks Part 5 – PoolHitTag
  7. Troubleshooting Pool Leaks Part 4 – Debugging Multiple Users for a Tag
  8. Troubleshooting Pool Leaks Part 3 – Debugging
  9. Troubleshooting Pool Leaks Part 2 – Poolmon
  10. Troubleshooting Pool Leaks Part 1 – Perfmon
  11. How To Deadlock Yourself (Don’t Do This)
  12. What Did Storport Do With My I/O?
  13. Hotfix to Enable Mini-Filter Performance Diagnostics With XPerf for Windows Server 2008R2
  14. Debugging a Crash, Found a Trojan
  15. Updated Archive of the NtDebugging Twitter Debug Tips
  16. Troubleshooting Memory Leaks With Just a Dump
  17. How the Clipboard Works, Part 2
  18. How the Clipboard Works, Part 1
  19. What Should Never Happen... Did
  20. Identifying Global Atom Table Leaks
  21. Stop 0x19 in a Large Pool Allocation

2011 15

  1. My Kernel Debugger Won't Connect
  2. Call Stacks for Pool Allocations
  3. Bcdedit Tips and Tricks For Debugging Part 1
  4. Determining The Interrupt Line For A Particular PCI-E Slot
  5. For testing purposes only, and other desktop watermarks
  6. LUN Discovery in a Nutshell
  7. Updated Archive of the Debug Ninja’s Twitter Debug Tips
  8. A Classic Case of Whodunit
  9. NTFS And 4K Disks
  10. Understanding Storage Timeouts and Event 129 Errors
  11. The Mystery of Lsass.exe Memory Consumption, (When all components get involved)
  12. Control Panel Policy and the Missing Icon
  13. Windows 7 XP Mode – Auto Publish ‘Not Available’
  14. Interpreting a WHEA error for a MCA fault
  15. Hunting for Bugs, but Found a Worm

2010 21

  1. New Joint Citrix/Microsoft Facebook Forum
  2. Expanding Netmon to aid in debugging
  3. Debugging a Bugcheck 0x109
  4. Debugging services startup in Svchost from a kernel mode debug session
  5. I Want A Debugger Robot
  6. Part 3: Understanding !PTE - Non-PAE and X64
  7. x64 Manual Stack Reconstruction and Stack Walking
  8. Storport ETW Logging to Measure Requests Made to a Disk Unit
  9. Understanding VSS in DPM
  10. A Case of Mysterious Memory Corruption
  11. Archive of the Debug Ninja’s Twitter debug tips
  12. Understanding !PTE, Part2: Flags and Large Pages
  13. Upcoming Blog ARTICLES
  14. How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive when capturing a system memory dump
  15. Critical Device Database TIP
  16. Video: Using XPERF to root cause CPU consumption
  17. We Need Your XPERF Feedback
  18. X64 Deep Dive Presentation from the 2010 Global Engineering Conference
  19. Understanding !PTE , Part 1: Let’s get physical
  20. Ironical Case of a Performance Monitoring Tool causing a Performance Issue!
  21. Case Study - Software Restriction Policies and Large EXE Files

2009 42

  1. Pool Fragmentation
  2. Part 3: ETW Methods of Tracing
  3. Part 2: Got Stack? No. We ran out and kv won’t tell me why!
  4. Part 1: Got Stack? No. We ran out of Kernel Mode Stack and kv won’t tell me why!
  5. System Won't Power Down
  6. WMI Nugget: How to Gather the Provider Binary from a WMI Class Name
  7. Part 2 - Exploring and Decoding ETW Providers using Event Log Channels
  8. Push Locks – What are they?
  9. Part 1 - ETW Introduction and Overview
  10. GES Team
  11. Using Xperf to investigate slow I/O issues
  12. Debugging a Bugcheck 0xF4
  13. Debug Nugget: DumpConfigurator Utility
  14. Who is restarting my server?
  15. Reversing in Reverse, Part 2: More Linked-List Pool Corruption
  16. Save Support Dollars by Checking Your Memory Dump before Calling Support
  17. Who is writing "Event ID 0" events to the application log?
  18. Ntdebugging on Twitter
  19. Reversing in Reverse: Linked-List Pool Corruption, a Complete Walkthrough (Part 1)
  20. WMI: "REFERENCES OF" query failure during Provider startup could be disastrous
  21. Capturing ADPlus CLR crashes
  22. XPERF DEMO: Michael Morales demonstrates the Windows Profiling Tool
  23. Using Netmon to figure out the source of high CPU in WMIprvse.exe
  24. XPERF Videos and other Blog Feedback
  25. Part 2: Tate Calhoun presents Xperf at the 2009 Microsoft GEC
  26. Part 1: Tate Calhoun presents Xperf at the 2009 Microsoft GEC
  27. T.Roy from CodeMachine presents 'Supporting Support' at the 2009 Microsoft GEC
  28. ‘Microsoft Platforms Global Escalation Services Community’ Presentation at the 2009 Microsoft GEC
  29. TSANet Presentation at the 2009 Microsoft GEC
  30. Help! My Server is Shutting Down for No Apparent Reason
  31. The Chat is Today - Windows NT Debugging Blog Live Chat
  32. Debug Fundamentals #4 : Spoiler
  33. Next Week: Windows NT Debugging Blog Live Chat
  34. It’s not my fault! – A case of remote code injection gone bad
  35. Global Engineering Conference
  36. Reminder: Windows NT Debugging Blog Live Chat 2 Coming Soon!
  37. Debug Fundamentals Exercise 4: The GAMEOVER exercise
  38. Windows NT Debugging Blog Live Chat 2
  39. Easily Resolving an Event Viewer Error using a Process Memory Dump
  40. Remote Debugging connecting to a Remote Stub using the Microsoft Debugging Tools for Windows
  41. Microsoft Windows Dynamic Cache Service
  42. Challenges of Debugging Optimized x64 Code

2008 51

  1. Debug Fundamentals Exercise 3: Calling conventions
  2. Debug Fundamentals Exercise 2: Some reverse engineering for Thanksgiving
  3. How to modify an application behavior when you don't have the source
  4. Debug Fundamentals Exercise 1: Reverse engineer a function
  5. Ntfs Misreporting Free Space (Part 2)
  6. Remote kernel or user mode debugging of dumps or live systems
  7. Windows Hotfixes and Updates - How do they work?
  8. Unlocking some puzzles requires building a better key... board
  9. NDIS Case Study 1 - NDIS Packet Double Completion
  10. Some of our favorite debugging-related links
  11. NDIS - Part 1
  12. Transcript of Windows NT Debugging Blog Live Chat
  13. New Facebook group: “Escalation Engineers”
  14. How to Access the User Mode Debugger from the Kernel Debugger
  15. Windows NT Debugging Blog Live Chat
  16. How can I find out why the Cluster Resource Monitor dumped – Access Violation
  17. What Are the Odds?
  18. Data Execution Protection in Action
  19. Exam preparation information for Exam 71-660
  20. NTFS Misreports Free Space?
  21. Tracking Down a Multi-Process Deadlock
  22. Join us on Facebook
  23. How it Works: DLL Injection
  24. Designing the Perfect Breakpoint
  25. Windbg Tip: KN, .Frame , DV, and DT - It's so easy
  26. How to debug WOW64 applications?
  27. NTDebugging Puzzler 0x00000007: Interlocked functions
  28. Beefier Breakpoints Using Debugger Scripts
  29. Platforms GES Team Photos
  30. Corrupt Page Table Pages Caught in the MDL
  31. Understanding NTFS Compression
  32. NTDebugging Puzzler 0x00000006: Invalid Handle - can you handle it?
  33. How to track down High CPU in User Mode Applications - A live debug!
  34. Smoking Gun Pool Corruption
  35. Tracking down MmSt paged pool usage
  36. Work Queues and Dispatcher Headers
  37. NTDebugging Puzzler 0x00000005 (Better late than never)
  38. How to have a colorful relationship with your dump files
  39. This didn’t puzzle the Debug Ninja, how about you? – The Complete Debug
  40. The Debug Ninja speaks: Debugging a stop 0x20
  41. NTDebugging Puzzler 0x00000003 (Matrix Edition) Some assembly required.
  42. Would you be interested in a live chat session on debugging techniques?
  43. Hardware bitflipping
  44. NTDebuggers Debug Puzzler 0x00000001 "Where did my process go?"
  45. Windows Performance Toolkit - Xperf
  46. Debugging a bluescreen at home
  47. NonPagedPool Depletion
  48. Wanted: Windows Internals subject matter experts
  49. The default interactive desktop heap size has been increased on 32-bit Vista SP1
  50. Disassemble the MBR
  51. Kernel Stack Overflows

2007 17

  1. WE ARE HIRING
  2. Survey Graphics
  3. ntdebug blog test page 2
  4. Too Much Cache?
  5. DNS Slow to Start?
  6. TalkBackVideo Understanding handle leaks and How to use !htrace to find them
  7. TalkBack Video: Cumulative Time Zone Update for Windows
  8. Talkback video: Desktop Heap
  9. LPC part 2 Kernel Debugger Extensions
  10. LPC (Local procedure calls) Part 1 architecture
  11. ntdebug blog test page
  12. Desktop Heap, part 2
  13. How Windows Starts Up (Part the second)
  14. Cluster Map of Visitors
  15. Where the rubber meets the road, or in this case the hardware meets the probe.
  16. How Windows Starts Up (part 1 of 4)
  17. Desktop Heap Overview

2006 1

  1. Getting Ready for Windows Debugging