I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the Windows Kernel?
What are some of my options?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityI am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the Windows Kernel?
What are some of my options?
You want VirtualKd. It is excellent and robust.
GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging.
The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4.
Around 34 min in the stream 1 he mentions the slowness of COM connection and around 38 he mentions usage of VirtualKd and why it works much faster. There's also a short installation/setup process.
Also there are some downsides of this one - as you need to install something on the machine (someone might don't want to do it). So what it's presented as the best solution (for him) is using physical Firewire but the setup requires separate machines.
I recommend to have a watch of those 4 streams if you are new into the topic.
If you are debugging a newer version of Windows (Windows 8 or higher I believe). You should checkout network based debugging. Works like a charm. No third party dependencies.
Just open up a cmd prompt as admin and type:
bcdedit /debug on
bcdedit /dbgsettings net hostip:w.x.y.z port:n
Checkout the MSDN docs for more info