.hh {command}
show help for command

Symbols and modules

show the symbol search path
ld {module-name}
(re)load symbols for a module
list all modules
lmvm {module-name}
dump information about a specific module
x {module-name}!{function}
resolve a native function address, wildcards accepted
ln {address}
find nearest symbol

Processes and Threads

processes list
switch to another process
.childdbg 1
enable child process debugging
list all threads
switch to another thread
~*{command} or ~e!{ext-command}
execute command on all the threads [^6]

Call stack

k [{number of frames}]
show the native call stack
show native call stacks for all threads
group threads call stacks and avoid duplicates
.frame [/c] {frame-number}
switch to another call stack frame


dv [{pattern}]
display local variables, need to have private symbols
? {expression} and ?? {c++-expression}
evaluate an expression
r [{registry-name}]
dump register value


d{format} {address}
dump memory in specific format
db {address}
bytes and ascii
dp {address}
pointer size
dps {address}
display addresses and symbols referencing them [^1]
dt {type} {address}
use specific type layout when dumping memory
!address {address}
show details about a memory region to which the address belongs
e{format} {address} {value(s)}
edit memory [^2]

Program Execution

u {address}
show disassembly
uf {address}
disassemble a function
continue until function finishes
step into code/assembly
enable source stepping
step over
{g|t|p}a {address}
step until a specific address
wt -l1 -oa -or
watch trace a function

Debugging events

sxe [-c {cmd1}] [-c2 {cmd2}] {exception|event}
enable a given exception or event [^3]
sxd {exception|event}
enable only 2nd chance notification (unhandled exceptions)
mark exception as handled


list all breakpoints
bp {address|function-name} [{command}]
create a breakpoint
b{e|d} {breakpoint-number}
enable/disable breakpoint
bc {breakpoint-number|*}
remove breakpoint
[~{thread-num}]ba {access}{size} {address} [{command}]
create data breakpoint [^4]


dx {expression}
navigate through debugging objects [^5]
.nvload {filename}
load type visualsation settings

Managed Code

show loaded extensions
.loadby sos coreclr
load SOS for .Net core
.loadby sos clr
load SOS for .Net Framework
! {command}
SOS help
list app domains
!dumpmt {address}
dump a method table
!dumpclass {address}
dump class detalis
!dumpmd {address}
dump method descriptor
!name2ee {module}!{type-or-method}
resolve a class name into method table, or method name into descriptor
!bpmd {module} {method}
create a method breakpoint
!bpmd -md {md}
create a method breakpoint
!bpmd {source-file}:{line-number}
create a method breakpoint
!bpmd -list
list breakpoints
!bpmd -clear {breakpoint-number}
remove breakpoint
!bpmd --clearall
remove all breakpoints
!eeheap [-gc] [-loader]
show information of clr memory
!dumpheap -stat
show managed heap stats
!dumpheap -mt {mt}
dump objects of a method type
!dumpheap -type {typename}
dump objects of a type
!dumpobj {address}
dump a managed object
!gcroot {address}
see references to an object
show objects registered for finalization
list all managed threads
show managed call stack of current thread
show complete call stack of current thread
show managed objects in the call stack
show exception details
!dumpil {md}
dump IL code for a method
!ip2md {address}
match assembly instruction with MD
u {md|address}
disassemble a method or code address


[^1] : dps @rsp

[^2] : eb 0x123456 'n' 'e' 'i' 'l'

[^3] : sxe clr

[^4] : ba r4 0x12345

[^5] : dx -r1 Debugger.Sessions

[^6] : ~*e!clrstack - show all managed callstacks for all threads