1

I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22).

1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10)

2- Target Machine: Windows 7 Pro x64

Now I'm trying to use the first machine to debug the second one. And I configured the same host pipe for the two machines.

  • Configuration for the serial port in the Host machine(also same in the Target machine)enter image description here

  • In the debugger (host) machine, I launches windbg with this settings

enter image description here

  • And I enabled debug mode on the debugee (target) machine

C:\Windows\system32>bcdedit/dbgsettings

debugtype Serial

debugport 1

baudrate 115200

But when I trying to connect, they don't seem to know each other.

What's wrong?

1
  • 1
    I don't know about MacOS host. But in Windows you have to map the com ports to the same named pipe in the Virtual Box. And, make sure one and only one of the virtual machines create the named pipe on startup
    – JavaMan
    May 26, 2017 at 10:32

1 Answer 1

1
  1. Start Debugger VM at first.

    WinDbg: com:port=com1,baud=115200
    
  2. Start Debuggee VM at second, and Enable Kernel Debug Mode.

    C:\Windows\system32>bcdedit /copy {current} /d "Windows Kernel Exploitation"   
    .... {bee4606e-51f1-11e8-97a8-decf25840cbf}
    
    C:\Windows\system32>bcdedit /debug {bee4606e-51f1-11e8-97a8-decf25840cbf} on   
    
    C:\Windows\system32>bcdedit /dbgsettings  
    debugtype               Serial   
    debugport               1  
    baudrate                115200
    

Debuggee

Windows Kernel Debuggee

Debugger

Windows Kernel Debugger

Windows Kernel WinDbg Output

2
  • I found different way when I have this problem. Than, it works..But I will try again asap. Thank you again.
    – Yavuz
    May 10, 2018 at 20:51
  • VirtualBox is slow for windows kernel debug, maybe you can try another vm platform(ex, Vmware, VirtualFD).
    – debug
    May 14, 2018 at 23:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.