Share the ideas and thoughts, become united ...

Saturday, June 4, 2011

SpeedUp Windows Kernel Debugging - VirtualKD + VMPlayer + WinDbg

Traditional windows kernel debugging requires two PC ( host & target ) to be connected via serial null modem. As this connection is an emulated modem, the debugging speed is very low. Also you need two PC in order to perform debugging.

VirtualKD & VMPlayer together now made it possible to speedup debugging in same PC !!!

Steps to the speedup debugging -

1. Install VMPlayer.

2. Install the target system (which you want to use for debugging) in the VMPlayer.

3. Run the guest OS (target system) in VMPlayer.

4. Install VirtualKD in guest OS



5. Make sure you have selected "Make new boot entry" while installing the VirtualKD


6. Now your guest OS be restarted. Open the vmmon.exe or vmmon64.exe (based on your OS) in the host (original PC). This application will try to patch the VMPlayer to make the debugging possible on the VMPlayer.


7. Set up the debugger path in the vmmon.



8. Now run the guest OS and select the entry which has "[debugger enabled]" prefix entry.


9. Running the guestOS will bring up the Debugger and it will try to connect with the ruuning os.


10. The debugger will automatically connect with the VirtualKD driver and execution of the windows kernel will be in break mode. Enter g (go) to resume the loading of the windows.

11. to stop execution of the windows kernel press Ctrl+Break in the WinDBG. This will stop the kernel execution and let you to enter command to the WinDbg like step, dataview , setting breakpoint etc.

12. To enable debugging we need to first setup the symbol file (.pdb). You can set the symbol path from "File" menu. Or you can enter the command .sympath+ <symbolpath> to extend symbol search path.

13. Next step is to set the source file search path. This is needed to debug line by line (step or p). 



That's it. Your high speed debugging environment is setup perfectly. Now if you load a program & set breakpoint, the debugger will automatically break execution on that point. If the correct symbols are shown to the debugger with the correct source code, you will be able to see which line is executing from the WinDBG (just like VS debugging).

To speed up more, you need to learn basic WinDBG commands.

Hope this article will help you. If you have any question or suggestion, please leave a comment.

No comments:

Post a Comment