5

I am Kernel debugging in Windbg and it's slow , very slow stepping through.

My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.

Is there a faster way to debug the Windows Kernel?

What are some of my options?

Improve this question
4
  • 2
    Check out "Slow kernel dbg with VirtualBox and WinDBG" and "Advice about first steps on reversing windows kernel", you may find your answer there. Commented Oct 20, 2017 at 21:54
  • Thanks for linking this. I looked for an answer but I guess I didn't use the magic keywords ) Commented Oct 21, 2017 at 8:26
  • 1
    I didn't used Vmware but, I'm using Hyper-V and serial ports for debugging Windows 7 32-bit. It is fast for me. Commented Oct 22, 2017 at 8:37
  • @de6f I'd like to test this because I want to test drivers. Commented Oct 22, 2017 at 16:03

3 Answers 3

Reset to default
10

You want VirtualKd. It is excellent and robust.

http://virtualkd.sysprogs.org

Improve this answer
3
  • I will test this out today. Thank you for the answer! Commented Oct 21, 2017 at 8:27
  • Tested it . This is indeed a lot more faster. Commented Oct 22, 2017 at 11:16
  • For some reason it took forever to get it to connect, it seems fine now though. Ironically this tool requires driver signing to be disabled which is exactly what I am testing. So I am not sure if this is the best tool for what I need but , you did answer the question. Commented Oct 22, 2017 at 11:18
4

GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging.

The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4.

Around 34 min in the stream 1 he mentions the slowness of COM connection and around 38 he mentions usage of VirtualKd and why it works much faster. There's also a short installation/setup process.

Also there are some downsides of this one - as you need to install something on the machine (someone might don't want to do it). So what it's presented as the best solution (for him) is using physical Firewire but the setup requires separate machines.

I recommend to have a watch of those 4 streams if you are new into the topic.

Improve this answer
2
  • These are both superb answers that it's hard to pick just one. Commented Oct 22, 2017 at 11:17
  • @ApertureSecurity No worries :) Commented Oct 22, 2017 at 15:43
2

If you are debugging a newer version of Windows (Windows 8 or higher I believe). You should checkout network based debugging. Works like a charm. No third party dependencies.

Just open up a cmd prompt as admin and type: bcdedit /debug on bcdedit /dbgsettings net hostip:w.x.y.z port:n

Checkout the MSDN docs for more info

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.