Entries:
Comments:
Posts:

Loading User Information from Channel 9

Something went wrong getting user information from Channel 9

Latest Achievement:

Loading User Information from MSDN

Something went wrong getting user information from MSDN

Visual Studio Achievements

Latest Achievement:

Loading Visual Studio Achievements

Something went wrong getting the Visual Studio Achievements

Defrag Tools: #27 - WinDbg - Configure Kernel Debugging

Download

Right click “Save as…”

In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer.

This installment goes over the cables and configuration steps required to set up kernel mode debugging.

We use these BCDEdit commands:

  • bcdedit
  • bcdedit /dbgsettings
  • bcdedit /dbgsettings 1394 channel:42
  • bcdedit /dbgsettings net hostip:192.168.0.10 port:50000 key:a.b.c.d
  • bcdedit /debug on
  • bcdedit /debug off

In the debug session, we use these commands:

  • .crash
  • .dump /f
  • lm
  • !lmi
  • .reload /f
  • !drvobj
  • !drvobj <module> 2
  • bl
  • bc *
  • be <N>
  • bd <N>
  • bp <function>
  • bm <wildcard>
  • x <wildcard>
  • g

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.

Resources:
NT Debugging Blog - How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining
NT Debugging Blog - Remoting Your Debug Crash Cart With KDNET [10th May 2013]
USBView
USB3 Debugging Cable
- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box!

Timeline:
[00:45] - Kernel Debugging Cables
[02:14] - USB 2.0
[04:13] - USB 3.0 - New in Windows 8/Windows RT
[05:30] - 1394 (Firewire)
[10:39] - Break
[11:38] - Driver Objects
[16:00] - Network - New in Windows 8/Windows RT
[17:30] - Breakpoint commands
[26:00] - Network - BCDEdit
[33:37] - SecureBoot and BitLocker

Tags:

Follow the Discussion

  • EdwardEdward

    Great show.
    btw as a little tid-bit of info... IEEE1394/FireWire is actually the first form of serialized SCSI. Thus why it has channels 0..63 - it's the number of SCSI id's/slots on a SCSI bus. The electrical transport specifications of 1394 has seen been obsoleted when connecting to hard drives. SAS (Serial Attached SCSI) Hard Drives now use the Nexus electrical standard - which is everywhere - GigE, PCIe, HDMI, SATA, SAS. The 1394 protocol lives on today in the SAS communciation protocol.

  • Brownie points to the first person who can tell me why my modem.sys breakpoint didn't get hit! I went back and watched the show later and figured out my mistake. Smiley

  • dan_tdtower Surface Fan

    Really like the whole series. This episode was good because the few times I've had to do this it was a bit of a pain so I'm glad this was covered.

    Serial Tablet Larry? That's some solid hardware; just keeps on ticking. Smiley

  • @ChadBeeder Re-watched that part a few times. At first I though you had left that breakpoint disabled but that doesn't seem to be the case. Perhaps the modem wasn't powered on in the first place and that function is never called?

    Anyway I'll be checking back to see if someone figures it out.

  • Andrew Richardswindev Andrew Richards

    Even I couldn't work it out - I guessed the same as you, that it was a disabled breakpoint or it wasn't powered on. Chad said he'd  answer it on the episode we tape tomorrow, and air on Monday.

  • FFEFFE

    Liked the show. Really nice. 

    I watch the part where the breakpoint was set on modem!ModemPower twice. My guess is the breakpoint needed to be on a different function? modem!PowerPnP? Maybe?

  • @FFE: You got it! I set the breakpoint on the dispatch routine for IRP_MJ_POWER (modem!ModemPower), then disabled the modem in device manager, which would result in, not a power IRP, but a Plug and Play IRP (IRP_MJ_PNP).

    I should have set the breakpoint on modem!ModemPnP instead of modem!ModemPower.

  • SimonSimon

    Crispin Glover?

  • MagicAndre1981Magic​Andre1981 xperf addicted

    Enabling Debug mode causes Windows to hang if no Debugger is connected

    http://support.microsoft.com/kb/2816225/en-us

  • charlescharles

    thank you

  • great page thank you

Remove this comment

Remove this thread

close

Comments Closed

Comments have been closed since this content was published more than 30 days ago, but if you'd like to continue the conversation, please create a new thread in our Forums,
or Contact Us and let us know.