WinDBG. How to catch first-chance exceptions?

Question

I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session.

I have written simple example application called Exceptions.exe:

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nShowCmd)
{
    MessageBox(NULL, "Press OK to generate exception.", "Title", MB_OK);
    __try
    {
        __asm
        {
            xor eax, eax
            mov dword ptr[eax], eax  // I wanna break here
        }
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        MessageBox(NULL, "In exception handler.", "Title", MB_ICONINFORMATION);
    }
    return 0;
}

I launch it in the being debugged system. Then go to windbg, press 'ctrl+break' and enter following commands:

3: kd> !process 0 0 Exceptions.exe
PROCESS 853b37e0  SessionId: 1  Cid: 0f48    Peb: 7ffdf000  ParentCid: 06c4
    DirBase: be658280  ObjectTable: 8f97acf8  HandleCount:  35.
    Image: Exceptions.exe

3: kd> .process /i 853b37e0
You need to continue execution (press 'g' ) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
3: kd> g
Break instruction exception - code 80000003 (first chance)
nt!RtlpBreakWithStatusInstruction:
82ab6110 cc              int     3
2: kd> sxe *
2: kd> g

I expect to break on the instruction mov dword ptr[eax], eax but nothing occurred. In the being debugged system I've got message box "In exception handler".

Is there any way to get what I want? I can't debug target process in user mode, because it's protected from attaching debugger.

Answer 1

In WinDbg: !gflag +soe

You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.