Detailed Windows kernel debugging process using virtual PC

The detailed process of Windows kernel debugging Using Virtual PC using windbg for Windows kernel debugging usually requires two ComputerOne is debuggee, and the other is used as the debugger and becomes the host. Using Virtual PC can perform kernel debugging on the same computer, which is useful for some debugging tasks.

The following uses virtual PC 2004 as an example to describe the detailed process of using virtual PC for Windows kernel debugging.

1. Download and install Virtual PC 2004.

2. Start the virutal PC console, create a new virtual PC, and configure the installation wizard.Hard DiskAnd memory.

3. InstallOperating System, ThisOperating SystemIt should be the Windows version you want to debug. For example, if you want to debug your driver on Windows Server 2003, install Windows Server 2003. Take Windows 2000 as an example.

4. Configure the serial port of the Virtual PC, select Windows 2000 in the Virtual PC console, click the Settings button to bring up the Settings dialog box, and then select COM1 in the list on the left (for example.

Select the named pipe option on the right, that is, use the named pipe to simulate the serial port, and enter the complete name of the pipe:File &://./Pipe/com_1, com_1 can be another name, but the previous part should remain unchanged.

5. Start Windows 2000 in the Virtual PC, enter the command line window, and execute the following command to add debugging options in the Startup Menu:

C:

CD/

Attrib-r-H

Edit boot. ini

Copy the last line and add the debugging option to the status as follows:

Click to view the chart

6. Select Restart Windows 2000 in the Virtual PC. When the Start menu appears, press the arrow key to stop automatic timing. Wait here.

Click to view the chart

In the same directory.

Windbg-k com: pipe, Port = //./pipe/com_1

8. Run the batch file to make it wait:

Click to view the chart

9. Switch to the virtual PC window, select one with "Debug enabled", and press enter to start.

10. Switch to the windbg window and observe that if everything goes well, the following similar information will be output:

Connected to Windows 2000 2195x86 compatible target, ptr64 false

Kernel debugger connection established.

Symbol search path is: SRV * C:/Symbols *

Http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 2000 kernel version 2195 up free x86 compatible

Kernel base = 0x80400000 psloadedmodulelist = 0x8046a4c0

System uptime: not available

11. Seeing the above information shows that windbg has successfully established a debugging conversation with Windows 2000 running in the Virtual PC. If you want to feel the pleasure of keeping windows under control, press Ctrl + break and Windows 2000 will be immediately locked as the button is pushed. The following information is displayed in windbg:

You are seeing this message because you pressed either

CTRL + C (if you run kd.exe) or,

CTRL + break (if you run windbg ),

On your debugger machine's keyboard.

This is not a bug or a system crash

If you did not intend to break into the debugger, press the "G" key, then

Press the "enter" key now. This message might immediately reappear. If it

Does, press "G" and "enter" again.

At this time, the windbg command prompt area will display * Busy * (or other invalid status, old windbg) for a period of time, because windbg is looking for debugging symbols.

After you are very familiar with the above process, you can not fully stick to the above process. For example, you can first run Windows 2000 with debugging options and then run windbg.

Finally, we will introduce several common failures:

1) Start windbg, but the error message shown is Win32 Error 2, indicating that the specified file name cannot be found. This is because the virtual PC has not been started and the MPs queue has not been created.File &://./Pipe/com_1. This file does not exist in the system. The Virtual PC should be run, even if it is only available to the startup option, this error will not occur again.

Click to view the chart