I'm trying to debug Windows XP's kernel with KD but every time I start the debugger,it seem to crash.
Setup
Windows 10 (host machine,running kd)
Windows XP x86 SP3 VM (being debugged)
- I configured a serial port with the following parameters:
- Edited boot.ini on the target OS
- (on VMware) Use named pipe
\\.\pipe\com_1
This end is the server
The other end is an application
When I try to connect to my VM I use:
kd -y srv*c:\symbols*https://msdl.microsoft.com/download/symbols -k com:port=\\.\pipe\com_1,pipe
After which I get this output:
Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\pipe\com_1
Kernel Debug Target Status: [no_debuggee]; Retries: [0] times in last [7] seconds.
Waiting to reconnect...
Unable to read head of debugger data list, Win32 error 0n56
Connected to Windows XP 2600 x86 compatible target at (Mon Oct 24 20:21:44.286 2016 (UTC + 2:00)), ptr64 FALSE
Kernel Debugger connection established.
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*c:\symbols*https://msdl.microsoft.com/download/symbols
Deferred srv*c:symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*https://msdl.microsoft.com/download/symbols;srv*c:symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805541c0
System Uptime: not available
52: ERROR: UMRxReadDWORDFromTheRegistry/ZwQueryValueKey: NtStatus = c0000034
ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 127
ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 127
ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 127
watchdog!WdUpdateRecoveryState: Recovery enabled.
Break instruction exception - code 80000003 (first chance)
*******************************************************************************
* *
* You are seeing this message because you pressed either *
* CTRL+C (if you run console kernel debugger) or, *
* CTRL+BREAK (if you run GUI kernel debugger), *
* on your debugger machine's keyboard. *
* *
* THIS IS NOT A BUG OR A SYSTEM CRASH *
* *
* If you did not intend to break into the debugger, press the "g" key, then *
* press the "Enter" key now. This message might immediately reappear. If it *
* does, press "g" and "Enter" again. *
* *
*******************************************************************************
nt+0x50d2c:
80527d2c cc int 3
kd>
Problems
- According to what I found searching around it is correct that the OS freezes as it is in debug mode. Can I actually run and stop it's execution later with breakpoints and such (I know breakpoints can be placed,but I don't know how to execute kernel code)?
- Also, I'm trying to decompile some routines, and I would like to know if there is any command that allows me to know whether arguments are required by the function.
Trying to use the following variable types in KD doesn't work (I guess they're not symbols). What can I do if I want to see the fields in these structures ?
NTKERNELAPI VOID KeInitializeApc ( IN PRKAPC Apc, IN PKTHREAD Thread, IN KAPC_ENVIRONMENT Environment, IN PKKERNEL_ROUTINE KernelRoutine, IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL, IN PKNORMAL_ROUTINE NormalRoutine OPTIONAL, IN KPROCESSOR_MODE ApcMode, IN PVOID NormalContext );
EDIT 1: whatever I had with 'g' is gone,and I can run the XP VM.
Trying to use the following variable types in KD doesn't work
- how are you using it? What are you trying to do? Apart from that - have you considered using other debuggers, such as WinDbg? It has a GUI and is much more friendly to beginners.