[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69BMM5G8J8WJWKBWB6J0SA7":3,"skill-same:01M69BMM5G8J8WJWKBWB6J0SA7":52},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":35,"ownerDescription":36,"updatedAt":37,"install":38,"resources":51},"01M69BMM5G8J8WJWKBWB6J0SA7","windbg-user-exception-triage",null,"Use when a native C\u002FC++ app, service, or user-mode driver host (including UMDF) crashes with a structured exception in a dump or WinDbg session, including native faults inside managed processes. Not for managed .NET exceptions, WinUI\u002FXAML app errors, or kernel bugchecks.","microsoft\u002Fwin-dev-skills","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69BM5T5HHSGVF6KZPTNENXK",510,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-exception-triage\u002FSKILL.md",[],[19,20,21,22,23],"triage","windbg user exception triage","kernel","winui","xaml","2026-11-10 10:12:30",false,"---\nname: windbg-user-exception-triage\ndescription: 'Use when a native C\u002FC++ app, service, or user-mode driver host (including UMDF) crashes with a structured exception in a dump or WinDbg session, including native faults inside managed processes. Not for managed .NET exceptions, WinUI\u002FXAML app errors, or kernel bugchecks.'\n---\n\n# User-Mode Exception Triage\n\n**Load `windbg-diagnostic-method` first** if it is not already loaded in this\nconversation, and apply it throughout for evidence ranking, hypothesis testing,\nconfidence calibration, independent review, and report validation. This skill\nadds the bug-family-specific commands and evidence requirements.\n\n## When to use\n\nStart here for access violations, heap corruption, stack overflow, fail-fast,\nbreakpoints, and other structured exceptions in a native application, service,\nor user-mode driver host process dump. This includes UMDF driver failures that\noccur in their user-mode host. Confirm\nthe dump type from WinDbg; the filename extension alone does not distinguish\nuser-mode from kernel-mode dumps.\n\n## Workflow\n\n### 1. Establish the exception context\n\n```text\n.exr -1\n.ecxr\nk\n!analyze -v\n```\n\nRecord the exception code, address, parameters, access type, registers, module,\nand stack. `.ecxr` selects the saved exception context when available. If no\nexception context was captured, report that limitation rather than treating the\ncurrently selected thread as the faulting thread.\n\nUse matching binaries and PDBs for your modules and public Windows symbols.\nInvestigate mismatches or truncated stacks before naming a failing source line.\n\n### 2. Classify and choose an available investigation\n\n| Evidence | Next step |\n|---|---|\n| `0xC0000005` with allocation\u002Ffree or overrun evidence | `windbg-user-heap-corruption-investigation` |\n| `0xC0000374` heap corruption | `windbg-user-heap-corruption-investigation` |\n| `0xC0000017`, `0x8007000E`, or an allocation-failure path | `windbg-user-virtual-memory-exhaustion` |\n| Lock\u002Funlock failure following coroutine suspension | `windbg-user-mutex-held-across-co-await` |\n| A TTD recording is available and earlier mutation is in question | `windbg-user-ttd-reverse-debugging-triage` |\n| No crash exception and evidence of blocked work | `windbg-user-wait-chain-analysis` |\n| A kernel dump reports a bugcheck | `windbg-kernel-bugcheck-triage` |\n\nDo not classify every address in a heap range as a lifetime bug. Check access\ntype, faulting instruction, object layout, and valid allocation boundaries.\n\n### 3. Investigate families without a dedicated skill\n\n- **Access violation without a match:** identify the read\u002Fwrite\u002Fexecute target,\n  object\u002Fregister used, and whether bounds, ownership, or synchronization was\n  violated. Distinguish a null pointer from stale or corrupted state.\n- **`0xC0000409` \u002F fail-fast:** inspect exception parameters and the documented\n  fast-fail subcode, then the failing condition and call path. The historical\n  status name alone does not prove a buffer overrun or rule one out. Not every\n  fast-fail carries an HRESULT.\n- **`0xC00000FD` \u002F stack overflow:** inspect stack bounds and frame sizes; test\n  recursion, reentrancy, large frames, and inability to commit stack growth.\n  Use the memory-exhaustion skill when commit evidence supports that branch.\n- **`0xE06D7363` \u002F MSVC C++ exception:** establish whether it was handled,\n  identify the throw\u002Fcatch path with available symbols, and inspect the\n  exception information supported by the runtime\u002Fversion. A first-chance throw\n  is not automatically a defect. This package does not decode thrown-object\n  layouts or fully diagnose `noexcept`\u002Ftermination behavior.\n- **Stowed\u002FWinRT exceptions:** preserved error information can precede the\n  final failure. Correlate its originating stack and nested errors with the\n  application; this package does not include a XAML extension workflow.\n- **Illegal instruction or breakpoint:** distinguish CPU\u002Farchitecture or\n  code-corruption hypotheses from intentional assertions\u002Fdebug breaks.\n\n## Validation\n\n- Exception context and code are established, or their absence is stated.\n- Faulting instruction and relevant object\u002Fregister agree with the hypothesis.\n- Alternatives are tested against evidence, not just stack names.\n- Missing memory, symbols, and specialized exception coverage are explicit.\n- The proposed fix addresses a demonstrated invariant and has a repro\u002Ftest plan.\n\n## References\n\n- [Exception context](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-ecxr--display-exception-context-record-)\n- [Exception record](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-exr--display-exception-record-)\n- [Controlling exceptions and events](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fcontrolling-exceptions-and-events)\n\n## Feedback\n\nFor this skill, follow the plugin's `FEEDBACK.md` and report a reviewed, sanitized\nissue to [WinDbg-Feedback](https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FWinDbg-Feedback\u002Fissues).\nInclude `windbg-user-exception-triage` and the package version from `plugin.json`; do not\nupload dumps or private source automatically.\n","# User-Mode Exception Triage\n\n**Load `windbg-diagnostic-method` first** if it is not already loaded in this\nconversation, and apply it throughout for evidence ranking, hypothesis testing,\nconfidence calibration, independent review, and report validation. This skill\nadds the bug-family-specific commands and evidence requirements.\n\n## When to use\n\nStart here for access violations, heap corruption, stack overflow, fail-fast,\nbreakpoints, and other structured exceptions in a native application, service,\nor user-mode driver host process dump. This includes UMDF driver failures that\noccur in their user-mode host. Confirm\nthe dump type from WinDbg; the filename extension alone does not distinguish\nuser-mode from kernel-mode dumps.\n\n## Workflow\n\n### 1. Establish the exception context\n\n```text\n.exr -1\n.ecxr\nk\n!analyze -v\n```\n\nRecord the exception code, address, parameters, access type, registers, module,\nand stack. `.ecxr` selects the saved exception context when available. If no\nexception context was captured, report that limitation rather than treating the\ncurrently selected thread as the faulting thread.\n\nUse matching binaries and PDBs for your modules and public Windows symbols.\nInvestigate mismatches or truncated stacks before naming a failing source line.\n\n### 2. Classify and choose an available investigation\n\n| Evidence | Next step |\n|---|---|\n| `0xC0000005` with allocation\u002Ffree or overrun evidence | `windbg-user-heap-corruption-investigation` |\n| `0xC0000374` heap corruption | `windbg-user-heap-corruption-investigation` |\n| `0xC0000017`, `0x8007000E`, or an allocation-failure path | `windbg-user-virtual-memory-exhaustion` |\n| Lock\u002Funlock failure following coroutine suspension | `windbg-user-mutex-held-across-co-await` |\n| A TTD recording is available and earlier mutation is in question | `windbg-user-ttd-reverse-debugging-triage` |\n| No crash exception and evidence of blocked work | `windbg-user-wait-chain-analysis` |\n| A kernel dump reports a bugcheck | `windbg-kernel-bugcheck-triage` |\n\nDo not classify every address in a heap range as a lifetime bug. Check access\ntype, faulting instruction, object layout, and valid allocation boundaries.\n\n### 3. Investigate families without a dedicated skill\n\n- **Access violation without a match:** identify the read\u002Fwrite\u002Fexecute target,\n  object\u002Fregister used, and whether bounds, ownership, or synchronization was\n  violated. Distinguish a null pointer from stale or corrupted state.\n- **`0xC0000409` \u002F fail-fast:** inspect exception parameters and the documented\n  fast-fail subcode, then the failing condition and call path. The historical\n  status name alone does not prove a buffer overrun or rule one out. Not every\n  fast-fail carries an HRESULT.\n- **`0xC00000FD` \u002F stack overflow:** inspect stack bounds and frame sizes; test\n  recursion, reentrancy, large frames, and inability to commit stack growth.\n  Use the memory-exhaustion skill when commit evidence supports that branch.\n- **`0xE06D7363` \u002F MSVC C++ exception:** establish whether it was handled,\n  identify the throw\u002Fcatch path with available symbols, and inspect the\n  exception information supported by the runtime\u002Fversion. A first-chance throw\n  is not automatically a defect. This package does not decode thrown-object\n  layouts or fully diagnose `noexcept`\u002Ftermination behavior.\n- **Stowed\u002FWinRT exceptions:** preserved error information can precede the\n  final failure. Correlate its originating stack and nested errors with the\n  application; this package does not include a XAML extension workflow.\n- **Illegal instruction or breakpoint:** distinguish CPU\u002Farchitecture or\n  code-corruption hypotheses from intentional assertions\u002Fdebug breaks.\n\n## Validation\n\n- Exception context and code are established, or their absence is stated.\n- Faulting instruction and relevant object\u002Fregister agree with the hypothesis.\n- Alternatives are tested against evidence, not just stack names.\n- Missing memory, symbols, and specialized exception coverage are explicit.\n- The proposed fix addresses a demonstrated invariant and has a repro\u002Ftest plan.\n\n## References\n\n- [Exception context](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-ecxr--display-exception-context-record-)\n- [Exception record](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebuggercmds\u002F-exr--display-exception-record-)\n- [Controlling exceptions and events](https:\u002F\u002Flearn.microsoft.com\u002Fwindows-hardware\u002Fdrivers\u002Fdebugger\u002Fcontrolling-exceptions-and-events)\n\n## Feedback\n\nFor this skill, follow the plugin's `FEEDBACK.md` and report a reviewed, sanitized\nissue to [WinDbg-Feedback](https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FWinDbg-Feedback\u002Fissues).\nInclude `windbg-user-exception-triage` and the package version from `plugin.json`; do not\nupload dumps or private source automatically.\n",{"name":5,"description":7},"main","5ce74fa89c49ca353c6ab03bd5889aa519aa9e5e","plugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-exception-triage",41,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-09 06:27:16",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":50},[40,43,46],{"tool":41,"command":42},"npx","npx skills add microsoft\u002Fwin-dev-skills --skill windbg-user-exception-triage",{"tool":44,"command":45},"bunx","bunx skills add microsoft\u002Fwin-dev-skills --skill windbg-user-exception-triage",{"tool":47,"command":48},"pnpm","pnpm dlx skills add microsoft\u002Fwin-dev-skills --skill windbg-user-exception-triage","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-exception-triage\u002FSKILL.md",true,[],[53,71,79,89,98,108],{"skillNo":54,"name":55,"nameZh":6,"description":56,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":57,"categories":58,"keywords":67,"publishedAt":24},"01M69BN1YCR77KBJHPBB1KBXAB","sample-skill","Sample skill used to test the catalog tooling. Use when testing CI. Not for real work.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fscripts\u002Ftests\u002Ffixtures\u002Flocal-plugin\u002Fplugins\u002Fsample\u002Fskills\u002Fsample-skill\u002FSKILL.md",[59,64],{"categoryNo":60,"categoryName":61,"taxonomyType":62,"taxonomyTypeDesc":63},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":65,"categoryName":66,"taxonomyType":62,"taxonomyTypeDesc":63},"01JBSEEDCAT000000000000023","Skill与智能体开发",[68,69,70],"sample skill","testing","test",{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":24},"01M69BMZFWAWBRE71DKPHT282F","windbg-user-wait-chain-analysis","Use when an app, service, or user-mode driver host is unresponsive on locks, COM\u002FRPC, I\u002FO, or another process; follow the blocker chain. Not for a crash solely from an exception stack.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-wait-chain-analysis\u002FSKILL.md",[],[78],"windbg user wait chain analysis",{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":24},"01M69BMX6T725RH7TZK7RDP8YQ","windbg-user-virtual-memory-exhaustion","Use when a native app, service, or user-mode driver host allocation fails; distinguish VA exhaustion, fragmentation, and commit pressure. Not for managed .NET heap growth, proving a leak from one snapshot, or corruption.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-virtual-memory-exhaustion\u002FSKILL.md",[],[86,87,88],"memory","windbg user virtual memory exhaustion","commit",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":24},"01M69BMTTSCGTJ6W18YNYDWEVE","windbg-user-ttd-reverse-debugging-triage","Use when an app, service, or user-mode driver host TTD recording is available and earlier calls, writes, or lifetimes matter. Not for kernel replay or history from a normal dump.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-ttd-reverse-debugging-triage\u002FSKILL.md",[],[19,96,97,21],"debugging","windbg user ttd reverse debugging triage",{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":24},"01M69BMRKH2MF07GD357PK5S4Q","windbg-user-mutex-held-across-co-await","Use when app, service, or user-mode driver C++ coroutine code holds a thread-affine lock across suspension and later hangs or fails. Not for all coroutine crashes or choosing lock performance.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-mutex-held-across-co-await\u002FSKILL.md",[],[105,106,107],"windbg user mutex held across co await","performance","code",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":24},"01M69BMPFX7S3D729F1N89AAP6","windbg-user-heap-corruption-investigation","Use when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds. Not for kernel pool corruption or ordinary OOM.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fwin-dev-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fwindbg\u002Fskills\u002Fwindbg-user-heap-corruption-investigation\u002FSKILL.md",[],[115,21],"windbg user heap corruption investigation"]