Comment Feed for Channel 9 - Defrag Tools: #27 - WinDbg - Configure Kernel Debugging http://media.ch9.ms/ch9/132b/17027c6b-3db6-44dd-93c0-ace61735132b/DefragTools27_220.jpg Channel 9 - Defrag Tools: #27 - WinDbg - Configure Kernel Debugging In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer. This installment goes over the cables and configuration steps required to set up kernel mode debugging. We use these BCDEdit commands: bcdedit bcdedit /dbgsettings bcdedit /dbgsettings 1394 channel:42 bcdedit /dbgsettings net hostip:192.168.0.10 port:50000 key:a.b.c.d bcdedit /debug on bcdedit /debug off In the debug session, we use these commands: .crash .dump /f lm !lmi .reload /f !drvobj !drvobj <module> 2 bl bc * be <N> bd <N> bp <function> bm <wildcard> x <wildcard> g Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution. Resources:NT Debugging Blog - How to Setup a Debug Crash Cart to Prevent Your Server from Flat LiningNT Debugging Blog - Remoting Your Debug Crash Cart With KDNET [10th May 2013]USBViewUSB3 Debugging Cable- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box! Timeline:[00:45] - Kernel Debugging Cables[02:14] - USB 2.0[04:13] - USB 3.0 - New in Windows 8/Windows RT[05:30] - 1394 (Firewire)[10:39] - Break[11:38] - Driver Objects[16:00] - Network - New in Windows 8/Windows RT[17:30] - Breakpoint commands[26:00] - Network - BCDEdit[33:37] - SecureBoot and BitLocker en Thu, 20 Jun 2013 02:01:04 GMT Thu, 20 Jun 2013 02:01:04 GMT Rev9 Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging btw as a little tid-bit of info... IEEE1394/FireWire is actually the first form of serialized SCSI. Thus why it has channels 0..63 - it's the number of SCSI id's/slots on a SCSI bus. The electrical transport specifications of 1394 has seen been obsoleted when connecting to hard drives. SAS (Serial Attached SCSI) Hard Drives now use the Nexus electrical standard - which is everywhere - GigE, PCIe, HDMI, SATA, SAS. The 1394 protocol lives on today in the SAS communciation protocol.

posted by Edward

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634962073364946843 Mon, 11 Feb 2013 19:22:16 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634962073364946843 Edward Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging Brownie points to the first person who can tell me why my modem.sys breakpoint didn't get hit! I went back and watched the show later and figured out my mistake. Smiley

posted by ChadBeeder

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634962213923311785 Mon, 11 Feb 2013 23:16:32 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634962213923311785 ChadBeeder Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging Really like the whole series. This episode was good because the few times I've had to do this it was a bit of a pain so I'm glad this was covered.

Serial Tablet Larry? That's some solid hardware; just keeps on ticking. Smiley

posted by dtower

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634962394849761868 Tue, 12 Feb 2013 04:18:04 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634962394849761868 dtower Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging @ChadBeeder Re-watched that part a few times. At first I though you had left that breakpoint disabled but that doesn't seem to be the case. Perhaps the modem wasn't powered on in the first place and that function is never called?

Anyway I'll be checking back to see if someone figures it out.

posted by ajasmin

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634963009075860933 Tue, 12 Feb 2013 21:21:47 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634963009075860933 ajasmin Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging Even I couldn't work it out - I guessed the same as you, that it was a disabled breakpoint or it wasn't powered on. Chad said he'd  answer it on the episode we tape tomorrow, and air on Monday.

posted by windev

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634963221707754700 Wed, 13 Feb 2013 03:16:10 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634963221707754700 windev Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging Liked the show. Really nice. 

I watch the part where the breakpoint was set on modem!ModemPower twice. My guess is the breakpoint needed to be on a different function? modem!PowerPnP? Maybe?

posted by FFE

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634965027082919840 Fri, 15 Feb 2013 05:25:08 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634965027082919840 FFE Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging @FFE: You got it! I set the breakpoint on the dispatch routine for IRP_MJ_POWER (modem!ModemPower), then disabled the modem in device manager, which would result in, not a power IRP, but a Plug and Play IRP (IRP_MJ_PNP).

I should have set the breakpoint on modem!ModemPnP instead of modem!ModemPower.

posted by ChadBeeder

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634965580953126933 Fri, 15 Feb 2013 20:48:15 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634965580953126933 ChadBeeder Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging posted by Simon

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634966726267245359 Sun, 17 Feb 2013 04:37:06 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634966726267245359 Simon Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging Enabling Debug mode causes Windows to hang if no Debugger is connected

http://support.microsoft.com/kb/2816225/en-us

posted by MagicAndre1981

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634978969401392377 Sun, 03 Mar 2013 08:42:20 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634978969401392377 MagicAndre1981 Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging posted by charles

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634987897977135964 Wed, 13 Mar 2013 16:43:17 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634987897977135964 charles Re: Defrag Tools: #27 - WinDbg - Configure Kernel Debugging great page thank you

posted by crb9922

]]> http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634987899443229773 Wed, 13 Mar 2013 16:45:44 GMT http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-27-WinDbg-Configure-Kernel-Debugging#c634987899443229773 crb9922