Windbg + VMware debug driver x86 x64

Recently, I have been learning Driver-related content, so it naturally involves debugging-driven issues. I have consulted a lot of materials, but I have not found any documents that can link the entire debugging framework. please correct me. Thank you!

1. Install windbg + VMware and configure the host and Virtual Machine

1. windbg is a free kernel-level debugging tool provided by Microsoft. It can be downloaded everywhere.

2. VMware is not free of charge, but the cracked version can be found online. I use 6.5.

3. After installing the above two software. Go to the next step. Configure the host and virtual machine.

4. Install the operating system in VMware (I installed WINXP and SP2 ). No. Please refer to the relevant materials.

5. Edit the boot. ini file under the C drive of the Windows XP operating system in VMware. In the [operating systems] section, add the following sentence:

Multi (0) disk (0) RDISK (0) Partition (1)/Windows = "Microsoft Windows XP Professional-Debug"/fastdetect/debug/debugport = COM1

6. Open the WINXP Device Manager in VMware and select port (COM1 ).

Figure 1

7. Double-click this "COM1". In the displayed dialog box, Set 2.

Figure 2

8. Shut down the Operating System Under VMware. Configure the hardware of the virtual machine, Vm-> Settings-> Add a serial port, and select "output
To Named Pipe ", and then next, keep the default //./pipe/com_1 in the first box.

Note: If you want to debug two or more VMS at the same time, you can change com_1 to com_2, com_3, and so on)

Select "this end is the server." In the second frame ."
In the third box, select "the other end is an application ."
Select "connect at power on"
Click "Advanced>" and select "yield CPU on Poll" in the new window ". Save and exit.
Well, all the above is what the virtual machine system has to do.

At this point, the virtual machine settings are basically complete.

9. Open our real operating system. (WINXP, SP2)

It weighs 6 or 7 steps, but it is in the real operating system.

10. Set a shortcut for windbg, that is, its runtime parameters. As follows:

"D:/program files/debugging tools for Windows/windbg.exe"-k com: Port = //./pipe/com_1, baud = 115200, pipe

"D:/program files/debugging tools for Windows/windbg.exe", this string is the path of your windbg.exe file, followed by the parameter. There are semicolons.

Note: "D:/program files/debugging tools for Windows (x64)/windbg.exe"-k com: pipe, Port = //. /pipe/com_1: The x64 host setting. The above is the x86 host setting.

Therefore, programs written in the vc6 and vs200x series under x64 can also be debugged through windbg.

Note: If you want to debug two or more VMS at the same time, you can change com_1 to com_2, com_3, and so on, select which one is based on your selection in step 2 (8th)

 

11. OK. All work is done. Open the VM now. Select "3" (note: in this case, enable windbg in the real host, and then perform Step 3. This step is critical. If you select step 3, then start windbg, then windbg will never connect to the VM)

Figure 3

12. Select the "enable debugging program" option in figure 3 and press Enter. The VMware operating system is paused. This is a key step. Many articles have not made it clear that debugging cannot be performed.

13. After completing step 12, run windbg in the real operating system to check whether the debugging information can be viewed, though not readable. At this time, the operating system under VMware began to enter our familiar welcome interface.

14. Open the monitor software in VMware's operations. I believe everyone has used it, and then file-> open driver. In this way, even our drivers are loaded.

15. Switch to the real host. In windbg, choose file-> open source file (or Ctrl + O). Then we can debug the application. The debugging method is the same as debugging the application, I just spoke nonsense.

Note: Our driver (that is. sys) files can be written either in the real system or in the operating system of VMware, but it is better to write files on the real host to facilitate debugging.

After writing so much, I wonder if I have solved your doubts. If you have any questions, please feel free to contact us. Thank you!

Finally, it is not in this way that kernel debugging can be performed. There are also many tools that can be processed in this way,

Such as kdvmware, http://www.zezula.net/en/fstools/kdvmware.html

Dual such as, virtualkd, http://virtualkd.sysprogs.org/tutorials/install/

The above two tools are also very good.