Windbg Kernel Irp Lifecycle Triage

microsoft/win-dev-skills/plugins/windbg/skills/windbg-kernel-irp-lifecycle-triage

researchResmi

Resmi Sağlayıcı Skill'iView repo

Use when kernel evidence shows stalled I/O, a power IRP, or completion/cancellation misuse; inspect request state and driver ownership. Not for interpreting an empty IRP search in a limited dump as proof of healthy I/O.

Dosyalar1 dosya

SKILL.md102 satır

Loading editor…

Kurulum

Önerilen

Tek komut — ajanınız otomatik olarak devreye alır.

AI aracını seç

Kurulum komutunu görmek için yukarıdan bir AI aracı seçin.

veya

Manuel Kurulum

Daha fazla adım

Dosyayı indirin ve ajanınızın sistem istemine yapıştırın.

Skill detayları

Versiyonv1.0.0

YazarMicrosoft

Kategoriresearch

Skill IDmicrosoft/win-dev-skills/plugins/windbg/skills/windbg-kernel-irp-lifecycle-triage

İlgili skill'ler

Windbg Diagnostic MethodUse with every WinDbg plugin investigation to apply evidence-first reasoning, confidence calibration, contrarian review, structured reporting, and deterministic validation. Not a bug-family-specific triage skill.Windbg Kernel Bugcheck TriageUse when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for user-mode process crashes or blaming a module from its name alone.Windbg Kernel Lock Deadlock TriageUse when kernel threads block on driver synchronization or Verifier reports a lock-order violation; build an owner/waiter graph. Not for treating every watchdog stop as a deadlock or listing every lock type with !locks.Windbg Kernel Verifier TriageUse when a kernel dump contains Driver Verifier violations; inspect flags, bugcheck subcodes, and available I/O shadow state. Not for Application Verifier user-mode stops or inferring a violation from enabled flags alone.Windbg User Exception TriageUse when a native C/C++ app, service, or user-mode driver host (including UMDF) crashes with a structured exception in a dump or WinDbg session, including native faults inside managed processes. Not for managed .NET exceptions, WinUI/XAML app errors, or kernel bugchecks.Windbg User Heap Corruption InvestigationUse when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds. Not for kernel pool corruption or ordinary OOM.