\n\nThis page has been machine-translated from the original page.
\n
In this article, I use the tutorial environment from Trying the WinDbg User-Mode Debugging Tutorial to summarize the basic UI operations in WinDbg.
\nFor a list of articles I have published about Windows debugging and dump analysis with WinDbg, please also see the following page.
\nReference: Debugging and Troubleshooting Techniques with WinDbg
\nThis article covers the following topics.
\n\nThe WinDbg version used here is WinDbg10.0.22000.1 AMD64.
This is the GUI immediately after starting WinDbg. It is running with administrator privileges.
\nEach button has the following function.
\n| No. | \nFunction | \nShortcut | \n
|---|---|---|
| 1 | \nOpen Source File | \nCtrl+O | \n
| 2 | \nInsert or remove breakpoint | \nF9 | \n
| 3 | \nCommand | \nAlt+1 | \n
| 4 | \nWatch | \nAlt+2 | \n
| 5 | \nLocals | \nAlt+3 | \n
| 6 | \nRegisters | \nAlt+4 | \n
| 7 | \nMemory Window | \nAlt+5 | \n
| 8 | \nCall Stack | \nAlt+6 | \n
| 9 | \nDisassembly | \nAlt+7 | \n
| 10 | \nScratch Pad | \nAlt+8 | \n
| 11 | \nProcesses and Threads | \nAlt+9 | \n
| 12 | \nCommand Browser | \nCtrl+N | \n
| 13 | \nSource mode ON | \nN/A | \n
| 14 | \nSource mode OFF | \nN/A | \n
| 15 | \nFont | \nN/A | \n
| 16 | \nOptions | \nN/A | \n
Descriptions of each toolbar button are provided in the following reference.
\nReference: Toolbar Buttons - Windows drivers | Microsoft Docs
\nThe following reference also documents the keyboard shortcuts.
\nReference: Keyboard Shortcuts - Windows drivers | Microsoft Docs
\nThe leftmost button on the toolbar, button 1, is the Open Source File button.
Clicking this button opens an Explorer window, where you can open a source file in WinDbg.\nNote: you cannot use it to open an executable or attach to a process.
\nReference: File Open Source File - Windows drivers | Microsoft Docs
\nThe shortcut key is [Ctrl+O].
\nButton 2 is Insert or remove breakpoint.
It is available only when the active window is either the Source window or the Disassembly window.
\nPress this button while a location is selected to toggle a breakpoint at that location.
\nThe shortcut key is [F9].
\nReference: Edit Breakpoints - Windows drivers | Microsoft Docs
\nFor example, in the following screenshot, a breakpoint is set on notepad!wWinMain in Notepad.
If you place the cursor on the line where the breakpoint is set (the highlighted line) and press the Insert or remove breakpoint button or the [F9] key, you can remove the breakpoint.
Conversely, if you execute this button on a line that does not already have a breakpoint (an unhighlighted line), you can set a new breakpoint there.
\nIf the Command window is closed, clicking button 3 opens a new Command window.
\nThe shortcut key is [Alt+1].
\nReference: View Command - Windows drivers | Microsoft Docs
\nClicking button 4 opens the Watch window.
\nThe shortcut key is [Alt+2].
\nReference: View Watch - Windows drivers | Microsoft Docs
\nThe Watch window displays information about global variables, local variables, and registers.\nFor details about the Watch window, see the following documentation.
\nReference: Using the Watch Window - Windows drivers | Microsoft Docs
\nClicking button 5 opens the Locals window.
\nThe shortcut key is [Alt+3].
\nReference: View Locals - Windows drivers | Microsoft Docs
\nIn the Locals window, you can view a list of local variables.
\nReference: Viewing and Editing Local Variables in WinDbg - Windows drivers | Microsoft Docs
\nClicking button 6 opens the Registers window.
\nThe shortcut key is [Alt+4].
\nReference: View Registers - Windows drivers | Microsoft Docs
\nFor how to display and edit registers in the Registers window, see the following documentation.
\nReference: Viewing and Editing Registers in WinDbg - Windows drivers | Microsoft Docs
\nClicking button 7 opens the Memory window.
\nThe shortcut key is [Alt+5].
\nReference: View Memory - Windows drivers | Microsoft Docs
\nFor more about the Call Stack window, see the following documentation.
\nReference: Displaying the Call Stack in WinDbg - Windows drivers | Microsoft Docs
\nClicking button 9 opens the Disassembly window.
\nThe shortcut key is [Alt+7].
\nReference: View Disassembly - Windows drivers | Microsoft Docs
\nIn the Disassembly window, you can display the assembly code of the debug target.
\nFor more about the Disassembly window, see the following documentation.
\nReference: Debugging Assembly Code in WinDbg - Windows drivers | Microsoft Docs
\nClicking button 10 opens the Scratch Pad window.
\nThe shortcut key is [Alt+8].
\nA Scratch Pad is a clipboard where you can enter and save text.
\nReference: Using the Scratch Pad - Windows drivers | Microsoft Docs
\nClicking button 11 opens the Processes and Threads window.
\nThe shortcut key is [Alt+9].
\nIn this window, you can browse a list of all processes being debugged.\nIn the example image below, the threads in the notepad.exe process are displayed in a tree under that process.
Here, processes are displayed in the format <internal decimal process index used by the debugger>:<hexadecimal process ID> application name of the process.
Likewise, each thread is displayed as <internal decimal thread index used by the debugger>:<hexadecimal thread ID>.
Reference: Controlling Processes and Threads in WinDbg - Windows drivers | Microsoft Docs
\n