Edit

Process Syntax

  • Article

Many debugger commands have process identifiers as their parameters. A vertical bar ( | ) appears before the process identifier.

The process identifier can be one of the following values.

Process identifier Description

|.

The current process.

|#

The process that caused the current exception or debug event.

|*

All processes.

|Number

The process whose ordinal is Number.

|~[PID]

The process whose process ID is PID. (The brackets are required and you cannot add a space between the tilde (~) and the opening bracket.)

|[Expression]

The process whose process ID is the integer to which the numerical Expression resolves.

Processes are assigned ordinals as they are created. Note that this number differs from the process ID (PID) that the Microsoft Windows operating system uses.

The current process defines the memory space and the set of threads that are used. When debugging begins, the current process is the one that caused the present exception or debug event (or the process that the debugger attached to). That process remains the current process until you specify a new one by using a |s (Set Current Process) command or by using the Processes and Threads window in WinDbg.

Process identifiers are used as parameters in several commands, frequently as the command prefix. Note that WinDbg and CDB can debug child processes that the original process created. WinDbg and CDB can also attach to multiple unrelated processes.

An example of the |[Expression] syntax would be |[@$t0]. In this example, the process changes depending on the value of a user-defined pseudo-register. This syntax allows debugger scripts to programmatically select a process.

Controlling Processes in Kernel Mode

In kernel mode, you cannot control processes by using process identifiers. For more information about how to access process-specific information in kernel mode, see Changing Contexts.