5

I am Kernel debugging in Windbg and it's slow , very slow stepping through.

My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.

Is there a faster way to debug the Windows Kernel?

What are some of my options?

4

3 Answers 3

9

You want VirtualKd. It is excellent and robust.

http://virtualkd.sysprogs.org

3
  • I will test this out today. Thank you for the answer!
    – LUser
    Oct 21, 2017 at 8:27
  • Tested it . This is indeed a lot more faster.
    – LUser
    Oct 22, 2017 at 11:16
  • For some reason it took forever to get it to connect, it seems fine now though. Ironically this tool requires driver signing to be disabled which is exactly what I am testing. So I am not sure if this is the best tool for what I need but , you did answer the question.
    – LUser
    Oct 22, 2017 at 11:18
4

GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging.

The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4.

Around 34 min in the stream 1 he mentions the slowness of COM connection and around 38 he mentions usage of VirtualKd and why it works much faster. There's also a short installation/setup process.

Also there are some downsides of this one - as you need to install something on the machine (someone might don't want to do it). So what it's presented as the best solution (for him) is using physical Firewire but the setup requires separate machines.

I recommend to have a watch of those 4 streams if you are new into the topic.

2
  • These are both superb answers that it's hard to pick just one.
    – LUser
    Oct 22, 2017 at 11:17
  • @ApertureSecurity No worries :) Oct 22, 2017 at 15:43
2

If you are debugging a newer version of Windows (Windows 8 or higher I believe). You should checkout network based debugging. Works like a charm. No third party dependencies.

Just open up a cmd prompt as admin and type: bcdedit /debug on bcdedit /dbgsettings net hostip:w.x.y.z port:n

Checkout the MSDN docs for more info

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.