Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD.
now the question is, is there any possibility of doing same thing (VirtualKD/WinDBG alternative) using a MacOS host and VMware Fusion? i can use GDB remote debugging or i have to do host to host (VM to VM) for debugging and it's even possible to kernel debugging using two VM?
Thanks
Yes, you can do kernel debugging using two VMs. You will need to connect their serial ports.
http://www.vmware.com/support/ws3/doc/ws32_devices3.html#1023828
The above is for Windows. OS X setup needs to be done manually: http://www.dcl.hpi.uni-potsdam.de/research/WRK/2011/01/running-wrk-on-mac-os-with-vmware-fusion/index.html
In the connection string on WinDbg/IDA side use the serial port, not a pipe as you're probably used to.
VirtualKD only works for VMWare running on Windows host so it won't help here.
GDB debugging is always possible too (with the debugStub.* settings). The advantage is that you don't need a second VM and can debug anything at all, including BIOS and any part of the kernel. The disadvantage is that you don't have nice meta-info provided by WinDbg such as modules, processes and symbols.
Power on the target VM, in an elevated command prompt:
bcdedit /debug on
bcdedit /dbgsettings serial debugport:1 baudrate:115200
Power off both the target (debuggee) and development (debugger) VMs.
Navigate to the .vmwarevm package for each VM, right click, select "Show Package Contents" (or cd into the VM's package).
Remove all references to the existing serial0 port, which is used for config-free printing. Copy-and-paste the configuration below, modifying it where necessary.
serial0.present = "TRUE"
serial0.pipe.endPoint = "client" # change to "server" for the target VM
serial0.fileType = "pipe"
serial0.yieldOnMsrRead = "TRUE"
serial0.startConnected = "TRUE"
serial0.fileName = "/tmp/kdpipe" # or any other world-writeable path
Power on your VMs, and use Windbg from the development VM to connect over com0.
Voila
In my experience VirtualKD will not work in this setup. I tried to get VisualDDK (same people and uses VirtualKD) to work in this exact setup but had no joy. In the end I installed bootcamp on my Mac, with Windows 7 as the host and VMWorkstation running my targets. Everything worked fine and it was all gravy.
