S
S
slinkinone2019-02-20 21:02:38
C++ / C#
slinkinone, 2019-02-20 21:02:38

How to debug Windows kernel drivers?

Good day!
Who has experience in developing kernel drivers and debugging them, please share your experience.
There are host and target cars (main OS and OS on VirtualBox , respectively; Windows 10 x64 on both). .NET , WDK is installed on the target machine , bcdedit is set to debug mode on the COM port (which is connected to the host via a pipe ), the system is switched to Test mode . After configuring bcdedit
and rebooting the virtual machine, the system loads noticeably longer than usual, but I see the output on the host in WinDbg .

Waiting for pipe \\.\pipe\vmcom
Waiting to reconnect...
Connected to Windows 10 10240 x64 target at (Wed Feb 20 20:48:20.804 2019 (UTC + 3:00)), ptr64 TRUE
Kernel Debugger connection established.
Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 10240 MP (1 procs) Free x64
Built by: 10240.17443.amd64fre.th1.170602-2340
Machine Name:
Kernel base = 0xfffff800`dfc16000 PsLoadedModuleList = 0xfffff800`dff3a070
System Uptime: 0 days 0:00:00.031
KDTARGET: Refreshing KD connection
------------------------------------------
Debuggee not connected

Using the OSR Loader , I try to run the driver (having previously installed the test certificate obtained after compiling the driver in the studio) and I get the error: The specified procedure could not be found. .
5c6d96193175b342416658.png
Using Dependency Walker , it was not possible to identify the problem. It showed missing files: WppRecorder.sys , WdfLdr.sys , msrpc.sys , EXT-MS-WIN-###.DLL . The " missing " .sys files are located in C:\Windows\System32\drivers . Moved them to C:\Windows\System32\ and Dependency Walker marked them as found. What byEXT-MS-WIN-###.DLL - it says that these dependencies can be skipped and not affect the work.
How to find the reason that the driver does not start?
What is the most convenient way to debug a kernel level driver? VM: target machine ( bcdedit ) + COM/NET + WinDbg + WPP Tracing ?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question