Windows Debugging

Windows Debugging

I rarely have to debug things under windows (thankfully) but that means when I do I have forgotten all the knowledge that I had learnt so slowly the time before. Hopefully this will remind me of things and help others as well.

* Process Monitor (Microsoft/SysInternals) can do the equivalent of truss. Use a filter to match your process.
* Process Explorer (Microsoft/SysInternals) can do the equivalent of lsof.

There are a couple of other useful free tools from Microsoft/SysInternals http://www.sysinternals.com

* Depends - similar to ldd to help with Windows DLL hell.
* Pstools - provides a set of command line Unix like process utils, such as pskill, psinfo.

A useful stand alone debugger is available from Microsoft http://www.microsoft.com/whdc/devtools/debugging plus other debugging resources.

At times when you need to kill a process we use "kill " in Unix platform. A similar command is there in Windows also, it's this:
taskkill /F /IM
In fact taskkill has got several other options also. You can list all the options by "taskkill /?" command.

"ps" command is used to list the running processes in Unix. We use "tasklist" in Windows.

REMEMBER: Windows is case insensitive, unlike Unix.

If you are working with Windows Event Logs then "EventCreate" is the command to generate a Windows Event Log entry. A sample is given below:
eventcreate /L Application /T ERROR /SO GMI0 /ID 1 /D "Test message %DATE% %TIME%"
Here is a simple script in Unix, which will actually create a batch file for Windows Environment which creates large number of events in Windows Event Log.
#! /bin/ksh
export COUNTER SOURCE
SOURCE=0

while [ $SOURCE -le 100 ]
do
SOURCE=`expr $SOURCE + 1`
COUNTER=0
while [ $COUNTER -le 1000 ]
do
COUNTER=`expr $COUNTER + 1`
echo "eventcreate /L Application /T ERROR /SO TESTAPP${SOURCE} /ID $COUNTER /D \"TESTAPP${SOURCE} : $COUNTER : Test event message : %DATE% %TIME%\""
done
done

-- Thanks to Jim Hutchinson for this script.