3

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I doing something wrong?

What I have done:

  1. In boot.ini I set /debugport=COM1 /baudrate=115200;
  2. In VirtualBox I forwarded COM1 to a named pipe \\.\pipe\debug;
  3. In WinDBG File > Kernel Debug... > COM tab: Ticked the "Pipe" check box, and for the Port = \\\\.\pipe\debug;

In WinDBG the debug session is found, and I can hit breakpoints, I can step through code, I can see the disassembled code in the "Disassembly window", and I can view memory locations in the "Memory window". But nothing shows up in WinDBG "Registers window".

The Host OS is Windows 10 and for the Virtual Guest OS i tried both Windows XP and Windows 7 both have the same issue.

I am really not sure where to look for answers to this issue, could anyone point me in the right direction ?

For anyone else having this issue or trying to learn kernel debugging i used parts from the following tutorials to get to where I am so far:

  1. Windows Kernel Debugging Tips (Virtualbox documentation);
  2. How to configure WinDbg for kernel debugging (blogpost).
Improve this question
1
  • Not sure where to look? First try another virtualization software to pin-point the blame.
    – conio
    Sep 2, 2017 at 21:57

2 Answers 2

Reset to default
3

You should try VirtualKD which uses a fast VM-specific mechanism to communicate with the debugger instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm not sure how to set it up with VMs...

Improve this answer
2
  • The better answer of the two. Hope this one gets accepted.
    – 0xC0000022L ♦
    Aug 30, 2017 at 21:23
  • Ethernet-based - the same way you set it up with physical computers, but it requires newer target Windows versions than OP said he used.
    – conio
    Sep 2, 2017 at 21:56
2

Fixed the issue this was a two part problem.

  1. Avast anti virus was slowing down the VM to a crawl solution uninstall avast or in some cases DISABLE the option: Settings > Troubleshooting > "Enable hardware assisted visualization"
  2. There is a bug in newer versions of WinDBG when debugging older versions of windows solution use an older version of WinDBG, or use the WinDBG command "r" to view the cpu registers rather than using the "Registers window", or use a WinDBG plugin to fix the issue https://stackoverflow.com/questions/35961246/windbg-not-showing-register-values
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.