windbg-user-ttd-reverse-debugging-triage

# TTD Reverse Debugging Triage **Load `windbg-diagnostic-method` first** if it is not already loaded in this conversation, and apply it throughout for evidence ranking, hypothesis testing, confidence calibration, independent review, and report validation. This skill adds the bug-family-specific commands and evidence requirements. ## Requirements and scope Time Travel Debugging records a user-mode process for replay, including an authorized application, service, or user-mode driver host process. A dump alone contains no execution timeline. Confirm a valid recording and matching module symbols before attempting timeline queries. It does not record kernel execution or automatically include another process's server-side activity. Recording can change timing, require substantial storage, and capture sensitive memory. Obtain authorization before capture. Check the installed recorder's help for supported target, architecture, and options. WinDbg's **Launch executable (advanced)** / **Record with Time Travel Debugging** flow can record a named test application without guessing a recorder command. ## Workflow ### 1. Open and index the recording Open the recorded `.run` file in WinDbg and load public Windows symbols and matching PDBs for your own binaries. ```text !tt.index dx @$cursession.TTD ``` Confirm the timeline range. Indexing and data-model availability depend on WinDbg/TTD versions; consult the installed help if the command is unavailable. ### 2. Ask a bounded history question ```text dx @$cursession.TTD.Calls("MyModule!MyFunction") dx @$cursession.TTD.Memory(<start-address>, <end-address>, "w") ``` Query the known function or exact memory range, then inspect relevant results and their timeline positions. An empty result can mean unmatched symbols, uninstrumented execution, or an out-of-range query, not proof of absence. Use the call query to find allocation/free or module lifetime transitions and the memory query to locate candidate writes. Account for allocator reuse: the same virtual address may represent different objects over the recording. ### 3. Seek and inspect state ```text !tt <position> k r g- ``` Seek to an actual position returned by the query. `g-` continues backward; use the installed reverse-step controls to refine the search. Capture the last-good and first-bad states, writer/caller stack, and ownership transition. Do not equate the last write with the bug until you establish the object's identity, valid lifetime, intended invariant, and relevant cross-thread order. ### 4. Continue with a shipped investigation | Evidence | Skill | |---|---| | Bad free/write or allocation-boundary violation | `windbg-user-heap-corruption-investigation` | | Growing allocation/reservation usage | `windbg-user-virtual-memory-exhaustion` | | Lock survives coroutine suspension | `windbg-user-mutex-held-across-co-await` | | Blocker or cross-process dependency at the selected moment | `windbg-user-wait-chain-analysis` | For other user-mode families continue reasoning from the timeline rather than dispatching to absent skills. For a kernel crash use `windbg-kernel-bugcheck-triage`; TTD is not a kernel-history substitute. ## Validation Record the question, trace identity, timeline positions, relevant object lifetime, and source/stack evidence. Test alternatives and state recording boundaries. A reproducible timeline proves what occurred in that recording; it does not establish that instrumentation preserved all production timing. ## References - [Time Travel Debugging overview](https://learn.microsoft.com/windows-hardware/drivers/debuggercmds/time-travel-debugging-overview) - [TTD data-model queries](https://learn.microsoft.com/windows-hardware/drivers/debuggercmds/time-travel-debugging-object-model) - [TTD extension commands](https://learn.microsoft.com/windows-hardware/drivers/debuggercmds/time-travel-debugging-extension-commands) ## Feedback Follow `FEEDBACK.md` and report a reviewed summary to [WinDbg-Feedback](https://github.com/microsoft/WinDbg-Feedback/issues). Include `windbg-user-ttd-reverse-debugging-triage` and the package version from `plugin.json`; never automatically upload a recording or its memory/query contents.