Defrag Tools

Defrag Tools: #27 - WinDbg - Configure Kernel Debugging

Download this episode

Download Video

Description

In this episode of Defrag Tools, Andrew Richards, Chad Beeder and Larry Larsen continue looking at the Debugging Tools for Windows (in particular WinDbg). WinDbg is a debugger that supports user mode debugging of a process, or kernel mode debugging of a computer.

This installment goes over the cables and configuration steps required to set up kernel mode debugging.

We use these BCDEdit commands:

  • bcdedit
  • bcdedit /dbgsettings
  • bcdedit /dbgsettings 1394 channel:42
  • bcdedit /dbgsettings net hostip:192.168.0.10 port:50000 key:a.b.c.d
  • bcdedit /debug on
  • bcdedit /debug off

In the debug session, we use these commands:

  • .crash
  • .dump /f
  • lm
  • !lmi
  • .reload /f
  • !drvobj
  • !drvobj <module> 2
  • bl
  • bc *
  • be <N>
  • bd <N>
  • bp <function>
  • bm <wildcard>
  • x <wildcard>
  • g

Make sure you watch Defrag Tools Episode #1 and Defrag Tools Episode #23 for instructions on how to get the Debugging Tools for Windows and how to set the required environment variables for symbol and source code resolution.

Resources:
NT Debugging Blog - How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining
NT Debugging Blog - Remoting Your Debug Crash Cart With KDNET [10th May 2013]
USBView
USB3 Debugging Cable
- Note, you must use a USB3 A-A cable designed for debugging, otherwise it will fry your box!

Timeline:
[00:45] - Kernel Debugging Cables
[02:14] - USB 2.0
[04:13] - USB 3.0 - New in Windows 8/Windows RT
[05:30] - 1394 (Firewire)
[10:39] - Break
[11:38] - Driver Objects
[16:00] - Network - New in Windows 8/Windows RT
[17:30] - Breakpoint commands
[26:00] - Network - BCDEdit
[33:37] - SecureBoot and BitLocker

Embed

Format

Available formats for this video:

Actual format may change based on video formats available and browser capability.

    The Discussion

    • Edward

      Great show.
      btw as a little tid-bit of info... IEEE1394/FireWire is actually the first form of serialized SCSI. Thus why it has channels 0..63 - it's the number of SCSI id's/slots on a SCSI bus. The electrical transport specifications of 1394 has seen been obsoleted when connecting to hard drives. SAS (Serial Attached SCSI) Hard Drives now use the Nexus electrical standard - which is everywhere - GigE, PCIe, HDMI, SATA, SAS. The 1394 protocol lives on today in the SAS communciation protocol.

    • ChadBeeder

      Brownie points to the first person who can tell me why my modem.sys breakpoint didn't get hit! I went back and watched the show later and figured out my mistake. Smiley

    • dtower

      Really like the whole series. This episode was good because the few times I've had to do this it was a bit of a pain so I'm glad this was covered.

      Serial Tablet Larry? That's some solid hardware; just keeps on ticking. Smiley

    • ajasmin

      @ChadBeeder Re-watched that part a few times. At first I though you had left that breakpoint disabled but that doesn't seem to be the case. Perhaps the modem wasn't powered on in the first place and that function is never called?

      Anyway I'll be checking back to see if someone figures it out.

    • windev

      Even I couldn't work it out - I guessed the same as you, that it was a disabled breakpoint or it wasn't powered on. Chad said he'd  answer it on the episode we tape tomorrow, and air on Monday.

    • FFE

      Liked the show. Really nice. 

      I watch the part where the breakpoint was set on modem!ModemPower twice. My guess is the breakpoint needed to be on a different function? modem!PowerPnP? Maybe?

    • ChadBeeder

      @FFE: You got it! I set the breakpoint on the dispatch routine for IRP_MJ_POWER (modem!ModemPower), then disabled the modem in device manager, which would result in, not a power IRP, but a Plug and Play IRP (IRP_MJ_PNP).

      I should have set the breakpoint on modem!ModemPnP instead of modem!ModemPower.

    • Simon

      Crispin Glover?

    • Magic​Andre1981

      Enabling Debug mode causes Windows to hang if no Debugger is connected

      http://support.microsoft.com/kb/2816225/en-us

    • charles

      thank you

    • crb9922

      great page thank you

    Comments closed

    Comments have been closed since this content was published more than 30 days ago, but if you'd like to continue the conversation, please create a new thread in our Forums, or Contact Us and let us know.