Extensions
Commands that start with an exclamation mark (!
) are extensions. These are exported from a DLL which users can create to extend the functionality of WinDbg.
Displaying information about the PEB and the TEB
!peb
!teb
Compare the previous two commands with:
dt nt!_PEB
dt nt!_PEB -r @$peb
dt nt!_TEB
Apparently, there are quite a few commands that rely on information found in the PEB and TEB:
lm
,
!dlls
,
!imgreloc
,
!tls
,
!gle
Address related
!address addr
and !vprot addr
display memory related information (protection, type, usage…)
!address rdx
!vprot rdx