Defrag Tools (HD) - Channel 9

In this episode of Defrag Tools, Chad Beeder is joined by Tim Misiak and Andy Luhrs to introduce WinDbg Preview, a new version of the WinDbg tool. Also see our followup episode: Defrag Tools #183 - WinDbg Preview Part 2 Related Links: WinDbg Preview (download from Microsoft Store)Documentation for WinDbg Preview (Dev Center)Announcement blog post Timeline: [00:00] Welcome and introductions[00:32] All new shell, and it's available as a Store app[01:17] Yes, all your old debugging commands and extensions still work[02:06] New features enabled by the debugger data model (for more on this topic, see Defrag Tools Episode #138 and Episode #139)[03:24] Use the Feedback Hub to help us make it better[04:17] All new UI. (Ribbon, relaunch recent sessions, new windowing system, dark theme)[07:05] Watch window, locals window, etc., can all use the new debugger data model[08:13] New script window - makes it easy to write NatVis and JavaScript visualizations[08:50] WinDbg Preview is a work in progress! Expect frequent updates.

In this episode of Defrag Tools, Chad Beeder and Andrew Richards are joined by Paresh Maisuria from the Windows Kernel Power team and Zach Holmes from the Fundamentals team to talk about System Power Report, a new feature in Windows 10 Creators Update. Related links:Defrag Tools #168 - Powercfg Sleep Study (older version of this tool)Defrag Tools #157 - Energy Estimation Engine (E3) (the framework used for estimating power usage) Timeline: [00:00] Welcome and introductions[00:30] This is an updated and expanded version of a feature previously called Sleep Study. Now it covers everything related to power, not just details of modern standby states.[02:55] You can still run it with powercfg /sleepstudy (for backwards compatibility) - but the new command is powercfg /systempowerreport, or powercfg /spr[04:08] Opening up the generated report - lots more data than in the old Sleep Study report.[05:32] Looking an active session: How much battery power was used, and by what? What was the screen brightness? Which apps used the most power?[09:40] Why some power usage gets attributed to "Unknown"[15:00] Unlike the old Sleep Study report, the System Power Report even gives useful info on traditional standby (S3) systems.[16:40] Looking at a standby session: You can tell why a system went into standby, and why it woke up. Also lots of other stats, like how long it took to hibernate, etc.[20:27] The report also contains an "expert tab" which contains data about the battery design capacity, current capacity, and health[23:18] Bugchecks are also logged in the report (including the parameters).[24:35] Still has all the details on a modern standby system (like in the old Sleep Study report). But enhanced. Now we have better instrumentation to track why a system got woken from standby.[27:58] Of interest to OEMs and hardware engineers: We track power usage data for the SoC (System on a Chip) subsystems. Can give you the first indication of where to look further if

In this episode of Defrag Tools, Graham McIntyre joins Andrew Richards and Chad Beeder to talk about the new Active Memory Dump type. This new kernel dump size replaces the Complete Memory Dump type, and although much smaller, is equally as useful.

In this episode of Defrag Tools, Andrew Richards and Chad Beeder walk through the process of manually creating a full memory dump via the keyboard. This is useful when you want to capture the state of the operating system. For example, to debug a hang. Resources: Forcing a System Crash from the Keyboard Registry files (.reg) demonstrated in this episode are on the Defrag Tools OneDrive share (ManualCrashRegistrySettings.zip) PCI Express Dump Switch Card (if you need to use the NMI method) Timeline: [00:00] Welcome and Intro[00:57] When would you need to manually force a crash dump?[02:42] Typically you'll want to get a Complete Memory Dump[05:57] ...which also requires you to set a large enough page file on the C: drive (RAM size plus some additional)[08:00] Setting up manual crash dump via CrashOnCtrlScroll (if your keyboard has a ScrollLock key)[13:20] Discussion of keyboards and keyboard scan codes. The old Peter Norton "pink shirt" book still comes through for this![16:55] Once you know the scan code, you can use the Dump1Keys and Dump2Key registry settings to choose your own keyboard combo. Make sure not to use CrashOnCtrlScroll at the same time![25:04] The big guns: If a system is hung badly enough that keyboard crash doesn't work, you can try CrashOnNMI. Usually requires special hardware like a PCIe NMI card.[28:34] Looking at the memory dump we just created. Bugcheck 0xE2: MANUALLY_INITIATED_CRASH

In this episode of Defrag Tools, Andrew Richards and Chad Beeder talk about the new features of Sysinternals ProcDump v9.0 Multiple Dumps per trigger in multiple Dump Sizes: -mm Write a 'Mini' dump file. (default) Includes the Process, Thread, Module, Handle and Address Space info-ma Write a 'Full' dump file. Includes All the Image, Mapped and Private memory-mp Write a 'MiniPlus' dump file. Includes all Private memory and all Read/Write Image or Mapped memory. To minimize size, the largest Private memory area over 512MB is excluded. A memory area is defined as the sum of same-sized memory allocations. The dump is as detailed as a Full dump but 10%-75% the size. Note: CLR processes are dumped as Full (-ma) due to debugging limitations-mc Write a 'Custom' dump file. Include memory defined by the specified MINIDUMP_TYPE mask (Hex). -md Write a 'Callback' dump file. Include memory defined by the MiniDumpWriteDump callback routine named MiniDumpCallbackRoutine of the specified DLL-mk Also write a 'Kernel' dump file. Includes the kernel stacks of the threads in the process. OS doesn't support a kernel dump (-mk) when using a clone (-r). When using multiple dump sizes, a kernel dump is taken for each dump sizeKernel Dump Support: Complete Thread Stack – Kernel & User Open the User and Kernel Dumps in separate debuggersMatch the TIDs from the User Dump, with the TIDs from the Kernel Dump, to get the entire stackAwesome tool for hang debugging!Debugging the Kernel Dump Dump includes the kernel stack (memory) of every thread in the process (Running, Ready or Idle)Dump has the Process PID and each Thread TID. There is no PEB or TEB information.View the Kernel Call Stack for each Thread in the Process:

!process -1 17

Debugging the User Dump View the User Call Stack for each Thread in the Process (e.g.):

~*k

!pde.deep

In this episode of Defrag Tools, Andrew Richards and Chad Beeder are joined by Alex Ionescu and Pavel Yosifovich, authors of the Windows Internals 7th Edition Part 1 book. We talk to Alex in the Channel 9 Studio and to Pavel over Skype from Israel. We cover the history of the Windows Internals book series, Alex's involvement in writing the 6th Edition and their co-authorship of the 7th Edition. The Windows Internals 7th Edition Part 1 is based on Windows 10 Creators Update, and is a must-have for any Troubleshooter or Developer! The Part 1 book covers: Understand Windows system architecture and its most important entities, such as processes and threadsExamine how processes manage resources and threads scheduled for execution inside processesObserve how Windows manages virtual and physical memoryDig into the Windows I/O system and see how device drivers work and integrate with the rest of the systemGo inside the Windows security model to see how it manages access, auditing, and authorization, and learn about the new mechanisms in Windows 10 and Windows Server 2016

In this episode of Defrag Tools, Andrew Richards and Chad Beeder delve into the way the Shell uses the registry to provide the Right-Click behavior of a (File Explorer) Folder. We add sub-menus to the Directory context menu, allowing a Command Prompt or PowerShell prompt to be opened in the current folder, either elevated and non-elevated. The registry file created is provided on Andrew's MSDN blog (Where in the API is Andrew Richards?), and the Defrag Tools OneDrive. Resources:Enhancing the "Open Command Prompt here" Context Menu experience (Andrew's MSDN blog)Creating Shortcut Menu Handlers (MSDN)

In this episode of Defrag Tools, Chad Beeder is joined by Jeffrey Tippet from the Windows Networking team to talk about how to debug networking problems in NDIS (Network Driver Interface Specification) using the !ndiskd debugger extension in WinDbg. Resources:The NDIS Blog Timeline:[00:00] Introductions[01:10] What is NDIS (Network Driver Interface Specification)[03:11] Common problems encountered by the Networking Team. (Bug Check 0x9F DRIVER_POWER_STATE_FAILURE, Bug Check 0x133 DPC_WATCHDOG_VIOLATION)[06:27] Introducing the !ndiskd debugger extension. Start with !ndiskd.help[10:27] !ndiskd.netreport gives you a Network Debug Report including graphical overview of the network configuration[18:23] !ndiskd.netreport -verbose takes much longer to run, but gives a lot more detail including animations of how many packets are going over each adapter[22:58] To enable the logging of recent network traffic, and get the animations in the netreport, enable NBL Logging by setting a registry key (documented here).[25:20] Wi-Fi can act like an access point in some cases (i.e. Wi-Fi Direct). How this shows up in the Network .[27:30] The other tabs on the report: Useful if you need to send the report to someone else.[31:34] DRIVER_POWER_STATE_FAILURE debugging tips: Use !ndiskd.oid to see which network OIDs (networking requests) are pending. One of these may be the power request which is holding up the network stack.[34:40] DPC_WATCHDOG_VIOLATION debugging tips[37:15] Comments/questions? Email us at [email protected]

In this episode of Defrag Tools, Andrew Richards and Chad Beeder are joined by Aaron Margosis. We talk about the Security Baseline for Windows 10. We also look at the Policy Analyzer and Local Group Policy Objects (LGPO) tools. Resources:Microsoft Security Guidance BlogPolicy Analyzer v3.1Local Group Policy Objects (LGPO)Aaron Margosis' Non-Admin, App-Compat and Sysinternals WebLogTroubleshooting with the Windows Sysinternals Tools, 2nd Edition

In this episode of Defrag Tools, Andrew Richards and Chad Beeder are joined by Aaron Margosis, the co-author of the Sysinternals book -- now in its 2nd Edition! Troubleshooting with the Windows Sysinternals Tools, 2nd Edition Resources:Defrag Tools: #81 - Aaron MargosisWindows Sysinternals Administrator's ReferenceTroubleshooting with the Windows Sysinternals Tools, 2nd EditionAaron Margosis' Non-Admin, App-Compat and Sysinternals WebLog