Using symmon

Using symmon

The symmon program is a standalone debug monitor that can display and modify memory, and stop, start, and trace execution, without using any kernel facilities. Using symmon you can set breakpoints in your driver, single-step its execution, and display the contents of driver and kernel variables.

The facilities of symmon are unsophisticated compared to the high-level debuggers you might use to debug a user-level application. For example, symmon does not understand C syntax, so it cannot display data structures as structures. Execution tracing is done at the level of machine instructions, not at the level of C statements.

However, you can use symmon to examine the operations of a kernel module in a running system, and resume execution of the system. This is an invaluable facility when debugging a new driver.

How symmon Is Entered
Commands of symmon
Syntax of Command Elements
Commands for Symbol Conversion and Lookup
Commands to Control Execution Flow
Commands to Manage Virtual Memory
Commands to Display Memory
Utility Commands