Kernel debugger essentials

.cache forcedecodeuser or .thread /p to translate PTEs to physical addresses.
.process # | .thread to switch context to a specific process
!process 0 0 to get list of processes.
and of course, !analyze -v to get a quick summary of a crash dump.

Comments

Popular posts from this blog

Did you ever have to analyze large log files before?

Google Appengine