Defrag Tools: #27 - WinDbg - Configure Kernel Debugging
- Posted: Feb 11, 2013 at 9:02 AM
- 45,843 Views
- 11 Comments
In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer.
This installment goes over the cables and configuration steps required to set up kernel mode debugging.
We use these BCDEdit commands:
- bcdedit
- bcdedit /dbgsettings
- bcdedit /dbgsettings 1394 channel:42
- bcdedit /dbgsettings net hostip:192.168.0.10 port:50000 key:a.b.c.d
- bcdedit /debug on
- bcdedit /debug off
In the debug session, we use these commands:
- .crash
- .dump /f
- lm
- !lmi
- .reload /f
- !drvobj
- !drvobj <module> 2
- bl
- bc *
- be <N>
- bd <N>
- bp <function>
- bm <wildcard>
- x <wildcard>
- g
Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.
Resources:
NT Debugging Blog - How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining
NT Debugging Blog - Remoting Your Debug Crash Cart With KDNET [10th May 2013]
USBView
USB3 Debugging Cable
- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box!
Timeline:
[00:45] - Kernel Debugging Cables
[02:14] - USB 2.0
[04:13] - USB 3.0 - New in Windows 8/Windows RT
[05:30] - 1394 (Firewire)
[10:39] - Break
[11:38] - Driver Objects
[16:00] - Network - New in Windows 8/Windows RT
[17:30] - Breakpoint commands
[26:00] - Network - BCDEdit
[33:37] - SecureBoot and BitLocker
Comment on the Post
Already have a Channel 9 account? Please sign in
More episodes in this show
-
Defrag Tools: #26 - WinDbg - Semaphores, Mutexes…
-
Defrag Tools: #27 - WinDbg - Configure Kernel…
-
Defrag Tools: #28 - WinDbg - Scheduling
Follow the Discussion
Oops, something didn't work.
What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in. You need to be signed in to Channel 9 to use this feature.What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in and view them all on your notifications page.sign up for email notifications?
Great show.
btw as a little tid-bit of info... IEEE1394/FireWire is actually the first form of serialized SCSI. Thus why it has channels 0..63 - it's the number of SCSI id's/slots on a SCSI bus. The electrical transport specifications of 1394 has seen been obsoleted when connecting to hard drives. SAS (Serial Attached SCSI) Hard Drives now use the Nexus electrical standard - which is everywhere - GigE, PCIe, HDMI, SATA, SAS. The 1394 protocol lives on today in the SAS communciation protocol.
Brownie points to the first person who can tell me why my modem.sys breakpoint didn't get hit! I went back and watched the show later and figured out my mistake.
Really like the whole series. This episode was good because the few times I've had to do this it was a bit of a pain so I'm glad this was covered.
Serial Tablet Larry? That's some solid hardware; just keeps on ticking.
@ChadBeeder Re-watched that part a few times. At first I though you had left that breakpoint disabled but that doesn't seem to be the case. Perhaps the modem wasn't powered on in the first place and that function is never called?
Anyway I'll be checking back to see if someone figures it out.
Even I couldn't work it out - I guessed the same as you, that it was a disabled breakpoint or it wasn't powered on. Chad said he'd answer it on the episode we tape tomorrow, and air on Monday.
Liked the show. Really nice.
I watch the part where the breakpoint was set on modem!ModemPower twice. My guess is the breakpoint needed to be on a different function? modem!PowerPnP? Maybe?
@FFE: You got it! I set the breakpoint on the dispatch routine for IRP_MJ_POWER (modem!ModemPower), then disabled the modem in device manager, which would result in, not a power IRP, but a Plug and Play IRP (IRP_MJ_PNP).
I should have set the breakpoint on modem!ModemPnP instead of modem!ModemPower.
Crispin Glover?
Enabling Debug mode causes Windows to hang if no Debugger is connected
http://support.microsoft.com/kb/2816225/en-us
thank you
great page thank you
Remove this comment
Remove this thread
close