[windbg]kd - sxe ld <dll> from a process context won't fire

Question

I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.

What i do is to first set sxe ld [process-name] let's say calc.exe.

Now, when I run calc it works, but when i set sxe ld [dll-name] (say kernel32/ntdll) it won't work.

Answer 1

I think usually this enables stopping on loading of kernel modules only (e.g. drivers). However, this SO answer claims it can work for user-mode processes if you send !gflag +ksl first (Enable loading of kernel debugger symbols).

It also describes how you can set process-specific kernel breakpoints, e.g.

kd> .process
    Implicit process is now 00112233`44556677
bp /p 0011223344556677 nt!NtMapViewOfSection

The NtMapViewOfSection syscall is used, among other purposes, to load DLLs so by stopping at it you should catch all further DLL loads.