Global Flag Reference

This reference describes the flags that Gflags sets in more detail.

Note  The symbolic name of each flag is provided for reference only. Because symbolic names change, they are not a reliable identifier of a global flag.

Buffer DbgPrint Output

The Buffer DbgPrint Output flag suppresses debugger output from DbgPrint, DbgPrintEx, KdPrint, and KdPrintEx calls.

Comments

When debugger output is suppressed, it does not automatically appear in the kernel debugger. However, it can still be accessed by using the !dbgprint debugger extension.

For information on debugger extensions, see Debugging Tools for NT-Based Operating Systems.

Create kernel mode stack trace database

The Create kernel mode stack trace database flag creates a run-time stack trace database of kernel operations, such as resource objects and object management operations, and works only when using the checked build of Windows.

Comments

GFlags displays this flag as a kernel-mode setting, but it is not effective in kernel mode because the kernel is already started.

Create user mode stack trace database

The Create user mode stack trace database flag creates a run-time stack trace database in the address space of a particular process (image file mode) or all processes (system-wide).

Debug initial command

The Debug initial command flag debugs the Client Server Run-time Subsystem (CSRSS) and the WinLogon process.

Comments

NTSD debugs the processes (using the command ntsd -d), but control is redirected to the kernel debugger.

See Debugging Tools for NT-Based Operating Systems for more details.

Note  GFlags displays this flag as a kernel-mode setting, but it is not effective in kernel mode because it cannot be set without rebooting Windows.

See also

Debug WinLogon, Enable debugging of Win32 subsystem

Debug WinLogon

The Debug WinLogon flag debugs the WinLogon service.

Comments

NTSD debugs Winlogon (by using the command ntsd -d -g -x), but control is redirected to the kernel debugger.

For more details, see Debugging Tools for NT-Based Operating Systems.

Note  GFlags displays this flag as a kernel-mode setting, but it is not effective in kernel mode because it cannot be set without rebooting Windows.

See Also

Debug Initial Command, Enable debugging of Win32 subsystem

Disable heap coalesce on free

The Disable heap coalesce on free flag leaves adjacent blocks of heap memory separate when they are freed.

Comments

By default, Windows combines ("coalesces") newly-freed adjacent blocks into a single block. Combining the blocks takes time, but reduces fragmentation that might force the heap to allocate additional memory when it cannot find contiguous memory.

This flag is used to test optimizing strategies. It is not used for debugging.

Disable paging of kernel stacks

The Disable paging of kernel stacks flag prevents paging of the kernel-mode stacks of inactive threads.

Comments

Generally, the kernel-mode stack cannot be paged; it is guaranteed to be resident in memory. However, Windows occasionally pages the kernel stacks of inactive threads. This flag prevents these occurrences.

The kernel debugger can provide information about a thread only when its stack is in physical memory. This flag is particularly important when debugging deadlocks and in other cases when every thread must be tracked.

Note  GFlags displays this flag as a kernel mode setting, but it is not effective in kernel mode because it cannot be set without rebooting Windows.

Disable protected DLL verification

The Disable protected DLL verification flag appears in GFlags, but it has no effect on Windows.

Disable stack extension

The Disable stack extension flag prevents the kernel from extending the stacks of the threads in the process beyond the initial committed memory.

Comments

This feature is used to simulate low memory conditions (where stack extensions fail) and to test the strategic system processes that are expected to run well even with low memory.

Early critical section event creation

The Early critical section event creation flag creates event handles when a critical section is initialized, rather than waiting until the event is needed.

Comments

When Windows cannot create an event, it generates the exception during initialization and the calls to enter and leave the critical section do not fail.

Because this flag uses a significant amount of nonpaged pool memory, use it only on very reliable systems that have sufficient memory.

Enable application verifier

The Enable application verifier flag enables system features that are used for user-mode application testing, such as page heap verification, lock checks, and handle checks.

Comments

This flag enables only the most basic detection features. To test user-mode applications reliably, use Application Verifier (AppVerif.exe), a tool included in the Windows Application Compatibility Toolkit. You can download the Application Compatibility Toolkit from the Windows Application and Customer Experience Web site. Use this flag only when the Application Verifier is not available.

Despite its name, this flag does not enable or configure any features of the Application Verifier tool.

Enable bad handles detection

The Enable bad handles detection flag raises a user-mode exception (STATUS_INVALID_HANDLE) whenever a user-mode process passes an invalid handle to the Object Manager.

Enable close exception

The Enable close exception flag raises a user-mode exception whenever an invalid handle is passed to the CloseHandle interface or related interfaces, such as SetEvent, that take handles as arguments.

Note  This flag is still supported, but the Enable bad handles detection flag (bhd), which performs a more comprehensive check of handle use, is preferred.

Enable debugging of Win32 subsystem

The Enable debugging of Win32 subsystem flag debugs the Client Server Run-time Subsystem (csrss.exe) in the NTSD debugger.

Comments

NTSD debugs the process by using the command ntsd -d -p 1.

This flag is effective only when the Debug Initial Command flag (dic) or the Debug WinLogon flag (dwl) is also set.

For details on NTSD, see Debugging Tools for NT-Based Operating Systems.

Note  GFlags displays this flag as a kernel-mode setting, but it is not effective in kernel mode because it cannot be set without rebooting Windows.

Enable exception logging

The Enable exception logging flag creates a log of exception records in the kernel run-time library. You can access the log from a kernel debugger.

Enable heap free checking

The Enable heap free checking flag validates each heap allocation when it is freed.

See Also

Enable heap tail checking, Enable heap parameter checking

Enable heap parameter checking

The Enable heap parameter checking flag verifies selected aspects of the heap whenever a heap function is called.

See Also

Enable heap validation on call

Enable heap tagging

The Enable heap tagging flag assigns unique tags to heap allocations.

Comments

You can display the tag by using the !heap debugger extension with the -t parameter.

For information about debugger extensions, see Debugging Tools for NT-Based Operating Systems.

See Also

Enable heap tagging by DLL

Enable heap tagging by DLL

The Enable heap tagging by DLL flag assigns a unique tag to heap allocations created by the same DLL.

Comments

You can display the tag by using the !heap debugger extension with the -t parameter.

For information about debugger extensions, see Debugging Tools for NT-Based Operating Systems.

See Also

Enable heap tagging

Enable heap tail checking

The Enable heap tail checking flag checks for buffer overruns when the heap is freed.

Comments

This flag adds a short pattern to the end of each allocation. The Windows heap manager detects the pattern when the block is freed and, if the block was modified, the heap manager breaks into the debugger.

See Also

Enable heap free checking, Enable heap parameter checking

Enable heap validation on call

The Enable heap validation on call flag validates the entire heap each time a heap function is called.

Comments

To avoid the high overhead associated with this flag, use the HeapValidate function instead of setting this flag, especially at critical junctures, such as when the heap is destroyed. However, this flag is useful for detecting random corruption in a pool.

See Also

Enable heap parameter checking

Enable loading of kernel debugger symbols

The Enable loading of kernel debugger symbols flag loads kernel symbols into the kernel memory space the next time Windows starts.

Comments

The kernel symbols are used in kernel profiling and by advanced kernel debugging tools.

Enable object handle type tagging

The Enable object handle type tagging flag appears in GFlags, but it has no effect on Windows.

Enable page heap

The Enable page heap flag turns on page heap verification, which monitors dynamic heap memory operations, including allocate and free operations, and causes a debugger break when the verifier detects a heap error.

Comments

This option enables full page heap verification when set for image files and standard page heap verification when set in system registry or kernel mode.

• Full page heap verification (for /i) places a zone of reserved virtual memory at the end of each allocation.
• Standard page heap verification (for /r or /k) places random patterns at the end of an allocation and examines the patterns when a heap block is freed.

Setting this flag for an image file is the same as typing gflags /p enable ImageFile /full for the image file at the command line.

Enable pool tagging

The Enable pool tagging flag collects data and calculates statistics about pool memory allocations sorted by pool tag value.

Comments

This flag is permanently set in Windows Server 2003 and later versions of Windows. On these systems, the Enable pool tagging checkbox in the Global Flags dialog box is dimmed and commands to enable or disable pool tagging fail.

Use ExAllocatePoolWithTag or ExAllocatePoolWithQuotaTag to set the tag value. When no tag value is specified (ExAllocatePool, ExAllocatePoolWithQuota), Windows creates a tag with the default value of "None." Because data for all allocations with a "None" tag is combined, you cannot distinguish the data for a specific allocation.

In Windows XP and earlier systems, this flag also directs Windows to attach a pool tag even when the pool memory is allocated by using ExAllocatePoolWithQuotaTag. Otherwise, the tag bytes are used to store the quota values. In Windows Server 2003, tag values and quota values are stored in separate fields that are attached to every pool memory allocation.

Note  To display the data that Windows collects about a tagged allocation, use the PoolMon.

The description of the Enable Pool Tagging flag in the Windows XP Support Tools documentation is incomplete. This flag directs Windows to collect and process data by tag value.

Enable system critical breaks

The Enable system critical breaks flag forces a system break into the debugger.

Comments

For per-process (image file), this flag forces a system break into the debugger whenever the specified process stops abnormally. This flag is effective only when the process calls the RtlSetProcessBreakOnExit and RtlSetThreadBreakOnExit interfaces.

For system-wide (registry or kernel mode), this flag forces a system break into the debugger whenever processes that have called the RtlSetProcessBreakOnExit and RtlSetThreadBreakOnExit interfaces stop abnormally.

Load DLLs top-down

The Load DLLs top-down flag loads DLLs at the highest possible address.

Comments

This flag is used to test 64-bit code for pointer truncation errors, because the most significant 32 bits of the pointers are not zeroes. It is designed for code running on the 64-bit versions of Windows Server 2003 and later versions of Windows.

Maintain a list of objects for each type

The Maintain a list of objects for each type flag collects and maintains a list of active objects by object type, for example, event, mutex, and semaphore.

Comments

To display the object list, use Open Handles (oh.exe), a tool included in the Windows 2000 Resource Kit, and now available for download from the Microsoft Windows 2000 Resource Kit Web site. Because Open Handles automatically sets the OTL flag, but does not clear it, use GFlags -otl to clear the flag.

Note  The linked lists created when you set this flag use eight bytes of overhead for each object. Remember to clear this flag when your analysis is complete.

This flag is available as a kernel-mode setting, but it is not effective in kernel mode because the kernel is already started.

Show loader snaps

The Show loader snaps flag captures detailed information about the loading and unloading of executable images and their supporting library modules and displays the data in the kernel debugger console.

Comments

For system-wide (registry or kernel mode), this flag displays information about driver loading and unloading operations.

For per-process (image file), this flag displays information about loading and unloading of DLLs.

Stop on exception

The Stop on exception flag causes the kernel to break into the kernel debugger whenever a kernel-mode exception occurs.

Comments

Windows passes all first chance exceptions (except for STATUS_PORT_DISCONNECT) with a severity of Warning or Error to the debugger before passing them to a local exception handler.

Stop on hung GUI

The Stop on hung GUI flag appears in GFlags, but it has no effect on Windows.