windows kernel debugging on Mac host (using VMware fusion)

Question

in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD.

now the question is, is there any possibility of doing same thing (VirtualKD/WinDBG alternative) using a MacOS host and VMware Fusion? i can use GDB remote debugging or i have to do host to host (VM to VM) for debugging and it's even possible to kernel debugging using two VM?

Thanks

Answer 1

Yes, you can do kernel debugging using two VMs. You will need to connect their serial ports.

http://www.vmware.com/support/ws3/doc/ws32_devices3.html#1023828

The above is for Windows. OS X setup needs to be done manually: http://www.dcl.hpi.uni-potsdam.de/research/WRK/2011/01/running-wrk-on-mac-os-with-vmware-fusion/index.html

In the connection string on WinDbg/IDA side use the serial port, not a pipe as you're probably used to.

VirtualKD only works for VMWare running on Windows host so it won't help here.

GDB debugging is always possible too (with the debugStub.* settings). The advantage is that you don't need a second VM and can debug anything at all, including BIOS and any part of the kernel. The disadvantage is that you don't have nice meta-info provided by WinDbg such as modules, processes and symbols.

Answer 2

Kernel Debugging with VMWare Fusion

Power on the target VM, in an elevated command prompt:

bcdedit /debug on
bcdedit /dbgsettings serial debugport:1 baudrate:115200

Power off both the target (debuggee) and development (debugger) VMs.

Navigate to the .vmwarevm package for each VM, right click, select "Show Package Contents" (or cd into the VM's package).

Remove all references to the existing serial0 port, which is used for config-free printing. Copy-and-paste the configuration below, modifying it where necessary.

serial0.present = "TRUE"
serial0.pipe.endPoint = "client" # change to "server" for the target VM
serial0.fileType = "pipe"
serial0.yieldOnMsrRead = "TRUE"
serial0.startConnected = "TRUE"
serial0.fileName = "/tmp/kdpipe" # or any other world-writeable path

Power on your VMs, and use Windbg from the development VM to connect over com0.

VMWare Fusion Power-On Order

• Terminology:
  • Client: You run windbg on this
  • Server: You break the kernel on this
• Steps:
  • Start the server first, since it is the pipe "server" and must create the pipe.
  • Start the client next.
  • Start windbg, and get it waiting on com0.
  • The server will have booted all the way into windows by now, so you won't be able to connect yet
  • Restart the server

Voila

Answer 3

In my experience VirtualKD will not work in this setup. I tried to get VisualDDK (same people and uses VirtualKD) to work in this exact setup but had no joy. In the end I installed bootcamp on my Mac, with Windows 7 as the host and VMWorkstation running my targets. Everything worked fine and it was all gravy.