I don&#39;t have the tool now, but as far as I remember it should be Ctrl+Break.

Sometimes Ctrl+Break doesnt work. At that point you may use Debug menu -&gt; Break.

Thanks


    Ctrl+Break 
will forcibly Debug break all but if for instance you entered some windbg command that takes a long time and you want to kill that then you should enter 

    Ctrl+c
This will kill the current running command.

You probably had &quot;http://msdl.microsoft.com/download/symbols&quot; in the symbol path.
Windbg will try to locate all your PDBs on Microsoft site :-(.&lt;br&gt;
Pressing Ctrl+Break is not fast enough.
What I usually do is to unplug the network cable, until Windbg wakes up.
Just be carfull, if Windbg was realy downloading one if its OS DLL, the DLL gets curropted. You will need .reload /o to fix that DLL. I only unplug when I know all OS DLL were already downloaded.

To avoid this delay in the first place, uncheck &quot;Resolve Unqualified Symbols&quot; found under the &quot;Debug&quot; menu.


In vi[m] there is the [`!` command which lets me pipe text][1] through a shell command -- like sort or indent -- and get the filtered text back into the buffer. Is there an equivalent in emacs?

  [1]: http://www.softpanorama.org/Editors/Vimorama/vim_piping.shtml

Filtering text through a shell command in Emacs

Given a credit card number and no additional information, what is the best way in PHP to determine whether or not it is a valid number?

Right now I need something that will work with American Express, Discover, MasterCard, and Visa, but it might be helpful if it will also work with other types.

What is the best way to validate a credit card in PHP?

Often WinDbg will enter a state where it is  **\*Busy\*** performing an operation. 

Often this is due to some mistake I made trying to *dt some_variable_itll_never_find* or setting a break point somewhere without symbols or the 1000&#39;s of other mistakes I make fumbling around this tool.

**Is there a way to cancel the current operation?**

How can I abort a long operation in WinDbg?

Often WinDbg will enter a state where it is *Busy* performing an operation.
Often this is due to some mistake I made trying to dt some_variable_itll_never_find or setting a break point somewhere without symbols or the 1000's of other mistakes I make fumbling around this tool.
Is there a way to cancel the current operation?


Is there a way to generate random number on Windows by reading from a file or psuedo-file or character special file, the way that can be done on Linux by reading from [/dev/random][1]?


  [1]: http://en.wikipedia.org/wiki/Urandom#Linux

Windows equivalent of /dev/random

Is there any way to set a system wide memory limit a process can use in Windows XP? I have a couple of unstable apps which do work ok for most of the time but can hit a bug which results in eating whole memory in a matter of seconds (or at least I suppose that&#39;s it). This results in a hard reset as Windows becomes totally unresponsive and I lose my work.

I would like to be able to do something like the /etc/limits on Linux - setting M90, for instance (to set 90% max memory for a single user to allocate). So the system gets the remaining 10% no matter what.

Set Windows process (or user) memory limit

I&#39;m using:

    FileInfo(
        System.Environment.GetFolderPath(
            System.Environment.SpecialFolder.ProgramFiles) 
        + @&quot;\MyInstalledApp&quot;

In order to determine if a program is detected on a users machine (it&#39;s not ideal, but the program I&#39;m looking for is a right old kludge of a MS-DOS application, and I couldn&#39;t think of another method).

On Windows XP and 32-bit versions of Windows Vista this works fine. However, on x64 Windows Vista the code returns the x64 Program Files folder, whereas the application is installed in Program Files x86. Is there a way to programatically return the path to Program Files x86 without hard wiring &quot;C:\Program Files (x86)&quot;?


C# - How to get Program Files (x86) on Windows 64 bit

During the installation of Apache2 I got the following message into cmd window:


&gt; Installing the Apache2.2 service The
&gt; Apache2.2 service is successfully
&gt; installed. Testing httpd.conf....
&gt; 
&gt; Errors reported here must be corrected
&gt; before the service can be started.
&gt; httpd.exe: Could not reliably
&gt; determine the server&#39;s fully qualified
&gt; domain name , using 192.168.1.3 for
&gt; ServerName (OS 10048)Only one usage of
&gt; each socket address (protocol/network
&gt; address/port) is normally permitted. 
&gt; : make_sock: could not bind to address
&gt; 0.0.0.0:80 no listening sockets available, shutting down Unable to
&gt; open logs Note the errors or messages
&gt; above, and press the &lt;ESC&gt; key to
&gt; exit.  24...

and after installing everything look fine, but it isn&#39;t. If I try to start service I got the following message:

&gt; Windows could not start the Apache2 on
&gt; Local Computer.  For more information,
&gt; review the System Event Log.  If this
&gt; is a non-Micorsoft service, contact
&gt; the service vendor, and refer to
&gt; service-specific error code 1.

Apach2 version is 2.2.9

Does anyone have the same problem, or could help me.




Windows could not start the Apache2 on Local Computer - problem

I noticed when a file is executed on Windows (.exe or .dll), it is locked and cannot be deleted, moved or modified.

Linux, on the other hand, does not lock executing files and you *can* delete, move, or modify them.

Why does Windows lock when Linux does not? Is there an advantage to locking?

Locking Executing Files: Windows does, Linux doesn&#39;t. Why?

So what I&#39;m looking for here is something like PHP&#39;s [print_r][1] function.

This is so I can debug my scripts by seeing what&#39;s the state of the object in question.


  [1]: http://us2.php.net/print_r

Is there a built-in function to print all the current properties and values of an object?

I&#39;ve been working for years with VS&#39;s debugger, but every now and then I come across a feature I have never noticed before, and think &quot;Damn! How could I have missed that? It&#39;s **so** useful!&quot;

[Disclaimer: These tips work in VS 2005 on a C# project, no guarantees for older incarnations of VS or other languages] 

### Keep track of object instances ###
Working with multiple instances of a given class? How can you tell them apart?
In pre-garbage collection programming days, it was easy to keep track of references - just look at the memory address. With .NET, you can&#39;t do that - objects can get moved around.
Fortunately, the watches view lets you right-click on a watch and select &#39;Make Object ID&#39;. 

&gt;&gt;![watches view][1] 

This appends a {1#}, {2#} etc. after the instance&#39;s value, effectively giving the instance a unique label. It looks like this: 
&gt;&gt; ![numbered instance][2]

The label is persisted for the lifetime of that object.

### Meaningful values for watched variables ###
By default, a watched variable&#39;s value is it&#39;s type. If you want to see its fields, you have to expand it, and this could take a long time (or even timeout!) if there are many fields or they do something complicated.

However, some predefined types show more meaningful information :

- strings show their actual contents
- lists and dictionaries show their elements count etc.

![meaningful info][3]

Wouldn&#39;t it be nice to have that for my own types? 

Hmm... 

...some quality time with .NET Reflector shows how easily this can be accomplished with the `DebuggerDisplay` attribute on my custom type:

    [System.Diagnostics.DebuggerDisplay(&quot;Employee: &#39;{Name}&#39;&quot;)]
    public class Employee {
        public string Name { get { ... } }
        ...
    }

... re-run, and...

![ta da!][4]

There&#39;s a lot more info on the subject here: [MSDN][5]

### Break on all exceptions ###
... even the ones that are handled in code!
I know, I&#39;m such a n00b for not knowing about this ever since I was born, but here it goes anyway - maybe this will help someone someday:

You can force a debugged process to break into debug mode each time an exception is thrown. Ever went on a bug hunt for hours only to come across a piece of code like this?

    try {
        runStrangeContraption();
    } catch(Exception ex) {
        /* TODO: Will handle this error later */
    }

Catching all exceptions is really handy in these cases.
This can be enabled from *Debug &gt; Exceptions... (Ctrl-Alt-E)*. Tick the boxes in the &#39;Thrown&#39; column for each type of exception you need.

-----

Those were a few forehead-slapping moments for me. 
Would you care to share yours?


  [1]: http://img403.imageshack.us/img403/461/52518188cq3.jpg
  [2]: http://img383.imageshack.us/img383/7351/11732685bl8.jpg
  [3]: http://img205.imageshack.us/img205/4808/37220487md1.jpg
  [4]: http://img60.imageshack.us/img60/926/79816018ha1.jpg
  [5]: http://msdn.microsoft.com/en-us/magazine/cc163974.aspx

Visual Studio debugger tips &amp; tricks for .NET

I have an ASP.NET website and when I press F5 it automatically attaches to the ASP.NET Development Server, how do I attach to IIS worker process instead when I press F5?





How do I attach the debugger to IIS instead of ASP.NET Development Server?

I keep wondering how does a debugger work? Particulary the one that can be &#39;attached&#39; to already running executable. I understand that compiler translates code to machine language, but then how does debugger &#39;know&#39; what it is being attached to?

How does a debugger work?

Is it possible to see the return value of a method after the line has been run and before the instruction pointer returns to the calling function?

I am debugging code I can&#39;t modify *(read: don&#39;t want to re-compile a third party library)*, and sometimes it jumps to code I don&#39;t have source to or the return expression has side effects that stop me being able to just run the expression in the *Display* tab.

Often the return value is used in a compound statement, and so the *Variables* view will never show me the value (hence wanting to see the result before control returns to the calling function).

**UPDATE:** I can&#39;t use the expression viewer as there are side-effects in the statement.


Can I find out the return value before returning while debugging in Eclipse?

The C#/.NET application I am working on is suffering from a slow memory leak.  I have used CDB with SOS to try to determine what is happening but the data does not seem to make any sense so I was hoping one of you may have experienced this before.

The application is running on the 64 bit framework.  It is continuously calculating and serialising data to a remote host and is hitting the Large Object Heap (LOH) a fair bit.  However, most of the LOH objects I expect to be transient: once the calculation is complete and has been sent to the remote host, the memory should be freed.  What I am seeing, however, is a large number of (live) object arrays interleaved with free blocks of memory, e.g., taking a random segment from the LOH:

    0:000&gt; !DumpHeap 000000005b5b1000  000000006351da10
             Address               MT     Size
    ...
    000000005d4f92e0 0000064280c7c970 16147872
    000000005e45f880 00000000001661d0  1901752 Free
    000000005e62fd38 00000642788d8ba8     1056       &lt;--
    000000005e630158 00000000001661d0  5988848 Free
    000000005ebe6348 00000642788d8ba8     1056
    000000005ebe6768 00000000001661d0  6481336 Free
    000000005f214d20 00000642788d8ba8     1056
    000000005f215140 00000000001661d0  7346016 Free
    000000005f9168a0 00000642788d8ba8     1056
    000000005f916cc0 00000000001661d0  7611648 Free
    00000000600591c0 00000642788d8ba8     1056
    00000000600595e0 00000000001661d0   264808 Free
    ...

Obviously I would expect this to be the case if my application were creating long-lived, large objects during each calculation.  (It does do this and I accept there will be a degree of LOH fragmentation but that is not the problem here.)  The problem is the very small (1056 byte) object arrays you can see in the above dump which I cannot see in code being created and which are remaining rooted somehow.

Also note that CDB is not reporting the type when the heap segment is dumped: I am not sure if this is related or not.  If I dump the marked (&lt;--) object, CDB/SOS reports it fine:

    0:015&gt; !DumpObj 000000005e62fd38
    Name: System.Object[]
    MethodTable: 00000642788d8ba8
    EEClass: 00000642789d7660
    Size: 1056(0x420) bytes
    Array: Rank 1, Number of elements 128, Type CLASS
    Element Type: System.Object
    Fields:
    None

The elements of the object array are all strings and the strings are recognisable as from our application code.

Also, I am unable to find their GC roots as the !GCRoot command hangs and never comes back (I have even tried leaving it overnight).

So, I would very much appreciate it if anyone could shed any light as to why these small (&lt;85k) object arrays are ending up on the LOH: what situations will .NET put a small object array in there?  Also, does anyone happen to know of an alternative way of ascertaining the roots of these objects?

---

Update 1

Another theory I came up with late yesterday is that these object arrays started out large but have been shrunk leaving the blocks of free memory that are evident in the memory dumps.  What makes me suspicious is that the object arrays always appear to be 1056 bytes long (128 elements), 128 * 8 for the references and 32 bytes of overhead.

The idea is that perhaps some unsafe code in a library or in the CLR is corrupting the number of elements field in the array header.  Bit of a long shot I know...

---

Update 2

Thanks to Brian Rasmussen (see accepted answer) the problem has been identified as fragmentation of the LOH caused by the string intern table!  I wrote a quick test application to confirm this:

    static void Main()
    {
        const int ITERATIONS = 100000;

        for (int index = 0; index &lt; ITERATIONS; ++index)
        {
            string str = &quot;NonInterned&quot; + index;
            Console.Out.WriteLine(str);
        }

        Console.Out.WriteLine(&quot;Continue.&quot;);
        Console.In.ReadLine();

        for (int index = 0; index &lt; ITERATIONS; ++index)
        {
            string str = string.Intern(&quot;Interned&quot; + index);
            Console.Out.WriteLine(str);
        }

        Console.Out.WriteLine(&quot;Continue?&quot;);
        Console.In.ReadLine();
    }

The application first creates and dereferences unique strings in a loop.  This is just to prove that the memory does not leak in this scenario.  Obviously it should not and it does not.

In the second loop, unique strings are created and interned.  This action roots them in the intern table.  What I did not realise is how the intern table is represented.  It appears it consists of a set of pages -- object arrays of 128 string elements -- that are created in the LOH.  This is more evident in CDB/SOS:

    0:000&gt; .loadby sos mscorwks
    0:000&gt; !EEHeap -gc
    Number of GC Heaps: 1
    generation 0 starts at 0x00f7a9b0
    generation 1 starts at 0x00e79c3c
    generation 2 starts at 0x00b21000
    ephemeral segment allocation context: none
     segment    begin allocated     size
    00b20000 00b21000  010029bc 0x004e19bc(5118396)
    Large object heap starts at 0x01b21000
     segment    begin allocated     size
    01b20000 01b21000  01b8ade0 0x00069de0(433632)
    Total Size  0x54b79c(5552028)
    ------------------------------
    GC Heap Size  0x54b79c(5552028)

Taking a dump of the LOH segment reveals the pattern I saw in the leaking application:

    0:000&gt; !DumpHeap 01b21000 01b8ade0
    ...
    01b8a120 793040bc      528
    01b8a330 00175e88       16 Free
    01b8a340 793040bc      528
    01b8a550 00175e88       16 Free
    01b8a560 793040bc      528
    01b8a770 00175e88       16 Free
    01b8a780 793040bc      528
    01b8a990 00175e88       16 Free
    01b8a9a0 793040bc      528
    01b8abb0 00175e88       16 Free
    01b8abc0 793040bc      528
    01b8add0 00175e88       16 Free    total 1568 objects
    Statistics:
          MT    Count    TotalSize Class Name
    00175e88      784        12544      Free
    793040bc      784       421088 System.Object[]
    Total 1568 objects

Note that the object array size is 528 (rather than 1056) because my workstation is 32 bit and the application server is 64 bit.  The object arrays are still 128 elements long.

So the moral to this story is to be very careful interning.  If the string you are interning is not known to be a member of a finite set then your application will leak due to fragmentation of the LOH, at least in version 2 of the CLR.

In our application&#39;s case, there is general code in the deserialisation code path that interns entity identifiers during unmarshalling: I now strongly suspect this is the culprit.  However, the developer&#39;s intentions were obviously good as they wanted to make sure that if the same entity is deserialised multiple times then only one instance of the identifier string will be maintained in memory.

Large Object Heap Fragmentation

I&#39;m trying to learn about reverse engineering, using Minesweeper as a sample application.  I&#39;ve found this [MSDN article][1] on a simple WinDbg command that reveals all the mines but it is old, is not explained in any detail and really isn&#39;t what I&#39;m looking for.

I have [IDA Pro disassembler][2] and the [WinDbg debugger][3] and I&#39;ve loaded winmine.exe into both of them.  Can someone provide some practical tips for either of these programs in terms of finding the location of the data structure that represents the mine field?

In WinDbg I can set breakpoints, but it is difficult for me to imagine at what point to set a breakpoint and at what memory location.  Similarly, when I view the static code in IDA Pro, I&#39;m not sure where to even begin to find the function or data structure that represents the mine field.

Are there any Reverse Engineers on Stackoverflow that can point me in the right direction?


  [1]: http://blogs.msdn.com/debuggingtoolbox/archive/2007/03/28/windbg-script-playing-with-minesweeper.aspx
  [2]: http://www.hex-rays.com/idapro/
  [3]: http://www.microsoft.com/whdc/devtools/debugging/installx86.Mspx

How can I find the data structure that represents mine layout of Minesweeper in memory?

How can I Save Output of a command in WinDbg to a Text File?

windbg: Command output to text file

Does anyone know how to get ahold of windbg without having to download the entire 620MB WDK ISO?

All I can find on the net to download the debugger is this link, which says you have to get the whole WDK: http://www.microsoft.com/whdc/devtools/debugging/default.mspx.




Getting windbg without the whole WDK?

Background: I&#39;m new to WinDbg and trying to get it running for the first time. I want to examine a memory dump I took from a running ASP.NET 4 site hosted in IIS 7 on Windows Server 2008 (x86) and downloaded to my local machine.

I installed the [debugging tools][1] and launched WinDbg for the first time, opening the crash dump. I went to **File | Symbol File Path** and set the path to `*srv*c:\symbols*http://msdl.microsoft.com/download/symbols*` and waited for all the symbols to load.

When trying to load SOS, I ran into problems. First, I tried the following command...

    .loadby sos mscorwks

...and received the response `Unable to find module &#39;mscorwks&#39;`.

After scouring the web, I tried to load mscorwks by executing the following command...

    sxe ld mscorwks.dll
    g

...and received the response &quot;No runnable debuggees error in &#39;g&#39;&quot;

I copied SOS.dll (from C:\Windows\Microsoft.NET\Framework\v4.0.30319) into the WinDbg directory, then tried...

    .load sos

...and received the error...

    The call to LoadLibrary(sos) failed, Win32 error 0n193
        &quot;%1 is not a valid Win32 application.&quot;
    Please check your debugger configuration and/or network access.

I&#39;m not quite sure how to proceed. I just want to load SOS and dig around this dump file. Any help would be greatly appreciated.

Fyi...I am trying to open the dump file on a 64-bit version of Windows 7 with the 64-bit version of Windbg.

  [1]: http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Content Type	Original Author	Original Content on Stackoverflow
Question	Aardvark	View Question on Stackoverflow
Solution 1 - Windows	hakan	View Answer on Stackoverflow
Solution 2 - Windows	joe	View Answer on Stackoverflow
Solution 3 - Windows	EdChum	View Answer on Stackoverflow
Solution 4 - Windows	Tal	View Answer on Stackoverflow

How can I abort a long operation in WinDbg?

Windows Problem Overview

Windows Solutions

Solution 1 - Windows

Solution 2 - Windows

Solution 3 - Windows

Solution 4 - Windows

What is the best way to validate a credit card in PHP?

Filtering text through a shell command in Emacs

Attributions