1、基本命令帮助
(1)断点指令
B[C|D|E] [<bps>]
clear|disable|enable breakpoints
 
BL
list breakpoints
 
BP <address>
set soft breakpoints
 
BA <access> <size> <addr>
break on access
 
(2)数据查看指令
D[type][<range>]
dump memory
 
DT [-n|y] [[mod!]name] [[-n|y]fields][address] [-l list] [-a[]|c|i|o|r[#]|v]
dump using type information
 
DV [<name>] 
dump local variables
 
(3)数据修改指令
E[type] <address> [<values>]
enter memory values
 
(4)运行
G[H|N] [=<address> [<address>...]] 
go
 
P [=<addr>] [<value>]
step over
 
(5)堆栈操作
K[b|p|P|v]
 
(6)显示加载的模块列表
LM
list modules
 
(7)寄存器操作
R [[<reg> [= <expr>]]]
view or set registers
 
(8)Search指令
S[<opts>] <range> <values>
search memory
 
(9)跟踪指令T,TA,TB,TC,WT,P,PA,PC
 
(10)退出
Q 
 

(11)反汇编

U [<range>]

unassemble

UF

(12)版本查看

version 

show debuggee and debugger version

(13)查看符号

X [<*|module>!]<*|symbol>

view symbols

(14)查看表达式

? <expr>

display expression

?? <expr> 

display C++ expression

 
2.扩展命令
(1)!analyze
作用：该扩展命令执行大量分析，显示出当前异常或bug的大量信息
语法：
User-Mode
!analyze [-v] [-f | -hang] [-D BucketID] 
!analyze -c [ -load KnownIssuesFile | -unload | -help ]
Kernel-Mode
!analyze [-v] [-f | -hang]  [-D BucketID] 
!analyze -c [ -load KnownIssuesFile | -unload | -help ]
!analyze -show BugCheckCode [BugParameters] 
 
(2)显示临界区
!locks 扩展、!critsec 扩展、!cs 扩展和 dt
 
3.WinDBG快捷键
ctrl+s: set symbol path
ctrl+i: set image path
ctrl+p: set source path
 
ctrl+d: load crash dump file
ctrl+e: load exe file
ctrl+o: open source file
ctrl+r: connect to remote session
ctrl+k: kernel debug
f6: attach to a process
 
f5: go
f10: step over
f11: step into
ctrl+shift+f5: restart
 
alt+1: command
alt+2: watch
alt+3: locals
alt+4: registers
alt+5: memory
alt+6: callstack
alt+7: disassambly
alt+8: stratch pad
alt+9: processes and threads