Loading Custom Debugger Extensions – !load and !dpx

Andrew Richards has developed a really custom .DLL, with some really nice debugger extensions for us debuggers to test out and use with dump files. The only one. I’ve used so far is the !dpx extension, which dumps all the useful information from a raw stack. This extension is going to replace the !thread and then dps method.

Firstly, you need to download the .DLL from SkyDrive, and unzip the folder. Once you have download and unzipped the folder, navigate to your appropriate operating system architecture, either x86 or x64, and then copy the .DLL. I’m not sure what the other folders contain as I haven’t watched the Defrag Tools video yet.

Once copied, you will need to paste the .DLL into this folder (follow these instructions below):

C:\ or the partition you have Windows installed on > Program Files > Windows Kits > 8.0 (dependent upon version) > Debuggers > x86 (or x64)

Paste the file into that folder, and then accept the UAC prompt.

You will then need to open a dump file, and use the !load extension with the .DLL name (doesn’t require file extension) to load the .DLL file. You will need to do this each time you open a dump file, but you shouldn’t have to, once that .DLL has been loaded for that dump file (well, I didn’t have to anyway). The !unload extension will unload the dump file.

!ProcDumpExt.help will list all the extensions contained with the .DLL, and explain what each extension does.

The DLL once loaded, also slightly improves the other stack unwind commands like k for instance, the stack frame numbers are also listed.


About 0x14c

I'm currently a Software Developer. My primary interests are Graph Theory, Number Theory, Programming Language Theory, Logic and Windows Debugging.
This entry was posted in WinDbg. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s