Defrag Tools

Defrag Tools: #27 - WinDbg - Configure Kernel Debugging

Play Defrag Tools: #27 - WinDbg - Configure Kernel Debugging
Sign in to queue

Description

In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer.

This installment goes over the cables and configuration steps required to set up kernel mode debugging.

We use these BCDEdit commands:

  • bcdedit
  • bcdedit /dbgsettings
  • bcdedit /dbgsettings 1394 channel:42
  • bcdedit /dbgsettings net hostip:192.168.0.10 port:50000 key:a.b.c.d
  • bcdedit /debug on
  • bcdedit /debug off

In the debug session, we use these commands:

  • .crash
  • .dump /f
  • lm
  • !lmi
  • .reload /f
  • !drvobj
  • !drvobj <module> 2
  • bl
  • bc *
  • be <N>
  • bd <N>
  • bp <function>
  • bm <wildcard>
  • x <wildcard>
  • g

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.

Resources:
NT Debugging Blog - How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining
NT Debugging Blog - Remoting Your Debug Crash Cart With KDNET [10th May 2013]
USBView
USB3 Debugging Cable
- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box!

Timeline:
[00:45] - Kernel Debugging Cables
[02:14] - USB 2.0
[04:13] - USB 3.0 - New in Windows 8/Windows RT
[05:30] - 1394 (Firewire)
[10:39] - Break
[11:38] - Driver Objects
[16:00] - Network - New in Windows 8/Windows RT
[17:30] - Breakpoint commands
[26:00] - Network - BCDEdit
[33:37] - SecureBoot and BitLocker

Tags:

Debugging, Tech Support

Embed

Download

Download this episode

More episodes in this series

Related episodes

The Discussion

  • User profile image
    Edward

    Great show.
    btw as a little tid-bit of info... IEEE1394/FireWire is actually the first form of serialized SCSI. Thus why it has channels 0..63 - it's the number of SCSI id's/slots on a SCSI bus. The electrical transport specifications of 1394 has seen been obsoleted when connecting to hard drives. SAS (Serial Attached SCSI) Hard Drives now use the Nexus electrical standard - which is everywhere - GigE, PCIe, HDMI, SATA, SAS. The 1394 protocol lives on today in the SAS communciation protocol.

  • User profile image
    ChadBeeder

    Brownie points to the first person who can tell me why my modem.sys breakpoint didn't get hit! I went back and watched the show later and figured out my mistake. Smiley

  • User profile image
    dtower

    Really like the whole series. This episode was good because the few times I've had to do this it was a bit of a pain so I'm glad this was covered.

    Serial Tablet Larry? That's some solid hardware; just keeps on ticking. Smiley

  • User profile image
    ajasmin

    @ChadBeeder Re-watched that part a few times. At first I though you had left that breakpoint disabled but that doesn't seem to be the case. Perhaps the modem wasn't powered on in the first place and that function is never called?

    Anyway I'll be checking back to see if someone figures it out.

  • User profile image
    windev

    Even I couldn't work it out - I guessed the same as you, that it was a disabled breakpoint or it wasn't powered on. Chad said he'd  answer it on the episode we tape tomorrow, and air on Monday.

  • User profile image
    FFE

    Liked the show. Really nice. 

    I watch the part where the breakpoint was set on modem!ModemPower twice. My guess is the breakpoint needed to be on a different function? modem!PowerPnP? Maybe?

  • User profile image
    ChadBeeder

    @FFE: You got it! I set the breakpoint on the dispatch routine for IRP_MJ_POWER (modem!ModemPower), then disabled the modem in device manager, which would result in, not a power IRP, but a Plug and Play IRP (IRP_MJ_PNP).

    I should have set the breakpoint on modem!ModemPnP instead of modem!ModemPower.

  • User profile image
    Simon

    Crispin Glover?

  • User profile image
    Magic​Andre1981

    Enabling Debug mode causes Windows to hang if no Debugger is connected

    http://support.microsoft.com/kb/2816225/en-us

  • User profile image
    charles

    thank you

  • User profile image
    crb9922

    great page thank you

Add Your 2 Cents