Category Archives: Debugging

MEX is Your Friend: Analyzing 32-bit Processes in a 64-bit Kernel Dump

Introduction In 2016, Microsoft publicly released a WinDBG extension called MEX. It has a number of commands that make life easier when kernel debugging or analyzing a crash dumps. You can download it here if you want to give it a … Continue reading

Posted in Debugging, Windbg | Leave a comment

Windows Subystem For Linux – File Reads

I’ve read a bit about the way that Microsoft has implemented the Windows Subsystem for Linux (WSL). A one sentence summary: all system calls in a WSL process are fulfilled by a special kernel driver called a pico provider. I … Continue reading

Posted in Debugging | Leave a comment

Debugging Windows Service Startup Using Procdump

tl;dr: Sleeping and attaching a debugger? Meh. Writing copious log files? Meh. In the case of a crashing service, it’s much easier to collect the crashdump and analyze. If you’ve spent much time developing Windows Service, you’ve probably run into the case … Continue reading

Posted in Debugging, Sysinternals Tools | Leave a comment