The Windows-X menu provides a rich launch experience into the troubleshooting tools of Windows, including Power Options, Event Viewer, System (also Win-Pause), Device Manager, Network Connections,…

The defaults for WinDbg (font, window layout, etc.) can be set by running WinDbg without a dump file. You configure your preferred look-and-feel and then use File | Save Workspace. We go over our…

The (Windows) Event Viewer shows the event of the system. The "Windows Logs" section contains (of note) the Application, Security and System logs - which have existed since Windows NT 3.1.…

The (Windows) Task Manager allows a user to view the performance of the system. It contains views that show the overall performance, and the performance per Package/Process. It also shows the…

The (Windows) Device Manager allows a user to view the hardware on the computer. You can use it to installed/update/remove the drivers for the device. The devices can be viewed by Type (e.g. Display…

The !teb extension displays a formatted view of the information in the thread environment block (TEB). The TEB contains information such as the Stack Memory Limits and Last Error/Status Codes.

The !peb extension displays a formatted view of the information in the process environment block (PEB). The PEB contains information such as Process Name, Module List, Environment Variables, Command…

Commands to display Bugcheck Secondary Dump Data. Microsoft Docs: .enumtag (Enumerate Secondary Callback Data)!pde.tagsBugCheckSecondaryDumpDataCallback routine!ext.blackbox*!sysinfo smbios!sysinfo…

The 32bits in an HRESULT error code have meanings, allowing the reader to gain additional insights into the error. Of note: The 32nd bit (the top bit) indicates if an error occurred or not. This is…

An Execute Access Violation occurs when the application attempts to execute code from a memory address that is invalid. To be valid, the memory page must have a valid state, protection and type. The…

A Read or Write Access Violation occurs when the application attempts to read or write memory from a memory address that is invalid. To be valid, the memory page must have a valid state, protection…

An Access Violation is a type of Exception caused when an application Reads, Writes or Executes an invalid Memory Address. The Exception Code is 0xC0000005 The first Exception Parameter (0) is the…

A CLR Exception is a type of Exception made by .NET applications. The exception is encapsulated in a class derived from the System.Exception class. The Exception Code is 0xE0434352 (a.k.a. Error…

A Fail Fast Exception is a type of Exception made by User Mode applications. The Exception Code is 0xC0000409 (a.k.a. STATUS_FAIL_FAST_EXCEPTION). The first Exception Parameter (0) defines the…

A Point-of-Failure (POF) Exception is a type of Exception made by UWP applications. It was introduced in the Windows 10 Fall Creators Update (Sept. 2017). The Exception Code is 0xC000027C. The first…

A Stowed Exception is a type of Exception made by UWP applications. It was introduced in Windows 8.0 as part of WinRT API (now known as UWP). The Exception Code is 0xC000027B. The first Exception…

The DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high. At the higher…

The DRIVER_POWER_STATE_FAILURE bug check has a value of 0x0000009F. This bug check indicates that the driver is in an inconsistent or invalid power state. Parameter 1 indicates the type of violation.…

The MANUALLY_INITIATED_POWER_BUTTON_HOLD bug check has a value of 0x000001C8. The bug check occurs when the power button is held for 7 seconds, but released before the UEFI Reset occurs at 10 seconds.…

MANUALLY_INITIATED_CRASH bug check has a value of 0x000000E2. The bug check occurs when a keystroke combination is entered on a PS/2 and/or USB Keyboard. To support the Ctrl-Ctrl-Scroll Lock keystroke…

The .trap command change to, and displays the trap frame register state of the context at the specified address. Trap Frames only exist in Kernel Mode. Trap Frames are used to store the registers of…

The .cxr command changes the debugger context. Using .cxr (without an address) resets the context to the default context. Using .cxr <address> sets the debugger context to the CONTEXT structure…

The .exr command displays the contents of an exception record (a EXCEPTION_RECORD structure). The EXCEPTION_RECORD structure contains the Instruction Address (the function raising the exception), the…

The .ecxr command changes to the context that is associated with the dump's exception. It displays the registers at that context. Use .cxr to reset the context to the default context. In general,…

The .lastevent command displays the most recent exception or event that occurred. The default debugger context is automatically set to the TID specified. To change the context manually, use the TID as…

The Windows SDK provides code and tools to aid the development and troubleshooting of applications and systems. For troubleshooting, it includes the: Windows Performance ToolkitDebugging Tools for…

Welcome to the Inside Show, the show that takes you inside Windows.In each ~5min episode, we review a Windows Feature, Windows Internal, Exception Code, Bugcheck Code or Debugger Command. The list of…