WinDbg how to debug user space in kernel mode

1: Use!process 0 0 to get information about all the processes of the user space

!process 0 0

NT ACTIVE PROCESS DUMP * * * *
PROCESS 80a02a60 cid:0002 peb:00000000 parentcid:0000
Dirbase:00006e05 objecttable:80a03788 tablesize:150.
Image:system

。。。。。

2: Use the. process/p + you need to switch the eprocess address of the application to the address space of the application

For example:

. process/p 0x80a02a60

3: Reload the user PDB file

. reload/f/user

4: Use non-intrusive switching process space

. process/i/P 0x80a02a60

5: Lower Application layer Breakpoint

Bp

Bu

All can

WinDbg how to debug user space in kernel mode