Why windbg skips syscall on kernel mode?

Question

I have a VM running windows with notepad open, I did list the modules with lm:

start             end                 module name
00007ffc`60fb0000 00007ffc`60fe2000   vertdll    (deferred)             
00007ffc`60ff0000 00007ffc`611e5000   ntdll    # (pdb symbols)          C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntdll.pdb\96EF4ED537402DAAA51D4A4212EA4B2C1\ntdll.pdb
fffff5cc`05c00000 fffff5cc`05ed3000   win32kbase   (deferred)             
fffff5cc`05f70000 fffff5cc`0600a000   win32k     (deferred)             
fffff5cc`064c0000 fffff5cc`06877000   win32kfull   (deferred)             
fffff5cc`06880000 fffff5cc`068c9000   cdd        (deferred)             
fffff801`40600000 fffff801`4088f000   mcupdate_GenuineIntel   (deferred)             
fffff801`40890000 fffff801`40896000   hal        (deferred)             
fffff801`408a0000 fffff801`408ae000   kdcom      (deferred)             
fffff801`408b0000 fffff801`408d7000   tm         (deferred)             
fffff801`408e0000 fffff801`4094a000   CLFS       (deferred)             
fffff801`40950000 fffff801`4096a000   PSHED      (deferred)             
fffff801`40970000 fffff801`4097b000   BOOTVID    (deferred)             
fffff801`40980000 fffff801`409ef000   FLTMGR     (deferred)             
fffff801`409f0000 fffff801`409fe000   cmimcext   (deferred)             
fffff801`40c00000 fffff801`40c7f000   cldflt     (deferred)             
fffff801`40c80000 fffff801`40c9a000   storqosflt   (deferred)             
fffff801`40ca0000 fffff801`40cc8000   bindflt    (deferred)             
fffff801`40cd0000 fffff801`40ce8000   lltdio     (deferred)             
fffff801`40cf0000 fffff801`40d08000   mslldp     (deferred)             
fffff801`40d10000 fffff801`40d2b000   rspndr     (deferred)             
fffff801`40d30000 fffff801`40d4d000   wanarp     (deferred)             
fffff801`40d50000 fffff801`40da6000   msquic     (deferred)             
fffff801`40db0000 fffff801`40f38000   HTTP       (deferred)             
fffff801`40f40000 fffff801`40f65000   bowser     (deferred)             
fffff801`40f70000 fffff801`40f8a000   mpsdrv     (deferred)             
fffff801`40f90000 fffff801`41024000   mrxsmb     (deferred)             
fffff801`41030000 fffff801`41076000   mrxsmb20   (deferred)             
fffff801`41080000 fffff801`4108a000   vmmemctl   (deferred)             
fffff801`41090000 fffff801`410e3000   srvnet     (deferred)             
fffff801`410f0000 fffff801`41104000   mmcss      (deferred)             
fffff801`41110000 fffff801`411d7000   srv2       (deferred)             
fffff801`411e0000 fffff801`41207000   Ndu        (deferred)             
fffff801`41210000 fffff801`412e6000   peauth     (deferred)             
fffff801`412f0000 fffff801`41305000   tcpipreg   (deferred)             
fffff801`41310000 fffff801`4132c000   rassstp    (deferred)             
fffff801`41330000 fffff801`4134d000   NDProxy    (deferred)             
fffff801`41350000 fffff801`4137b000   vmhgfs     (deferred)             
fffff801`41380000 fffff801`413a7000   AgileVpn   (deferred)             
fffff801`413b0000 fffff801`413d1000   rasl2tp    (deferred)             
fffff801`413e0000 fffff801`41401000   raspptp    (deferred)             
fffff801`41410000 fffff801`4142c000   raspppoe   (deferred)             
fffff801`41430000 fffff801`41442000   condrv     (deferred)             
fffff801`41450000 fffff801`4145f000   ndistapi   (deferred)             
fffff801`41460000 fffff801`4149b000   ndiswan    (deferred)             
fffff801`414a0000 fffff801`414b2000   WdNisDrv   (deferred)             
fffff801`419a0000 fffff801`41a13000   dxgmms1    (deferred)             
fffff801`41a20000 fffff801`41a3b000   monitor    (deferred)             
fffff801`41a40000 fffff801`41b21000   dxgmms2    (deferred)             
fffff801`41b30000 fffff801`41b59000   luafv      (deferred)             
fffff801`41b60000 fffff801`41b96000   wcifs      (deferred)             
fffff801`44a00000 fffff801`45a46000   nt         (pdb symbols)          C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\CA8E2F01B822EDE6357898BFBF8629971\ntkrnlmp.pdb
fffff801`46000000 fffff801`46114000   clipsp     (deferred)             
fffff801`46120000 fffff801`46149000   ksecdd     (deferred)             
fffff801`46150000 fffff801`461b3000   msrpc      (deferred)             
fffff801`461c0000 fffff801`461d1000   werkernel   (deferred)             
fffff801`461e0000 fffff801`461ec000   ntosext    (deferred)             
fffff801`461f0000 fffff801`462d4000   CI         (deferred)             
fffff801`462e0000 fffff801`4639b000   cng        (deferred)             
fffff801`463a0000 fffff801`46471000   Wdf01000   (deferred)             
fffff801`46480000 fffff801`46493000   WDFLDR     (deferred)             
fffff801`464a0000 fffff801`464af000   SleepStudyHelper   (deferred)             
fffff801`464b0000 fffff801`464c1000   WppRecorder   (deferred)             
fffff801`464d0000 fffff801`464f6000   acpiex     (deferred)             
fffff801`46500000 fffff801`4654c000   mssecflt   (deferred)             
fffff801`46550000 fffff801`4656a000   SgrmAgent   (deferred)             
fffff801`46570000 fffff801`4663c000   ACPI       (deferred)             
fffff801`46640000 fffff801`4664c000   WMILIB     (deferred)             
fffff801`46650000 fffff801`46660000   WdBoot     (deferred)             
fffff801`46670000 fffff801`466db000   intelpep   (deferred)             
fffff801`466e0000 fffff801`466f7000   WindowsTrustedRT   (deferred)             
fffff801`46700000 fffff801`4670b000   IntelTA    (deferred)             
fffff801`46710000 fffff801`4671b000   WindowsTrustedRTProxy   (deferred)             
fffff801`46720000 fffff801`46734000   pcw        (deferred)             
fffff801`46740000 fffff801`4674b000   msisadrv   (deferred)             
fffff801`46750000 fffff801`467c7000   pci        (deferred)             
fffff801`467d0000 fffff801`467e5000   vdrvroot   (deferred)             
fffff801`467f0000 fffff801`467fb000   intelide   (deferred)             
fffff801`46800000 fffff801`46844000   ucx01000   (deferred)             
fffff801`46850000 fffff801`4687f000   pdc        (deferred)             
fffff801`46880000 fffff801`4689a000   CEA        (deferred)             
fffff801`468a0000 fffff801`468d1000   partmgr    (deferred)             
fffff801`468e0000 fffff801`4698a000   spaceport   (deferred)             
fffff801`46990000 fffff801`469a3000   PCIIDEX    (deferred)             
fffff801`469b0000 fffff801`469c9000   volmgr     (deferred)             
fffff801`469d0000 fffff801`46a1f000   sdbus      (deferred)             
fffff801`46a20000 fffff801`46a83000   volmgrx    (deferred)             
fffff801`46a90000 fffff801`46aa8000   vsock      (deferred)             
fffff801`46ab0000 fffff801`46acc000   vmci       (deferred)             
fffff801`46ad0000 fffff801`46ae8000   urscx01000   (deferred)             
fffff801`46af0000 fffff801`46b0e000   mountmgr   (deferred)             
fffff801`46b10000 fffff801`46b2f000   lsi_sas    (deferred)             
fffff801`46b30000 fffff801`46be3000   storport   (deferred)             
fffff801`46bf0000 fffff801`46bfd000   atapi      (deferred)             
fffff801`46c00000 fffff801`46c3c000   ataport    (deferred)             
fffff801`46c40000 fffff801`46c72000   storahci   (deferred)             
fffff801`46c80000 fffff801`46c9c000   EhStorClass   (deferred)             
fffff801`46ca0000 fffff801`46cba000   fileinfo   (deferred)             
fffff801`46cc0000 fffff801`46d00000   Wof        (deferred)             
fffff801`46d10000 fffff801`46d6a000   WdFilter   (deferred)             
fffff801`46d70000 fffff801`47048000   Ntfs       (deferred)             
fffff801`47050000 fffff801`47083000   usbccgp    (deferred)             
fffff801`47090000 fffff801`4709e000   USBD       (deferred)             
fffff801`470a0000 fffff801`470ad000   urschipidea   (deferred)             
fffff801`470b0000 fffff801`470ca000   usbehci    (deferred)             
fffff801`470d0000 fffff801`47149000   USBPORT    (deferred)             
fffff801`47150000 fffff801`471d5000   usbhub     (deferred)             
fffff801`471e0000 fffff801`47283000   UsbHub3    (deferred)             
fffff801`47290000 fffff801`4729d000   Fs_Rec     (deferred)             
fffff801`472a0000 fffff801`47410000   ndis       (deferred)             
fffff801`47420000 fffff801`474b8000   NETIO      (deferred)             
fffff801`474c0000 fffff801`474f2000   ksecpkg    (deferred)             
fffff801`47500000 fffff801`477eb000   tcpip      (deferred)             
fffff801`477f0000 fffff801`4786f000   fwpkclnt   (deferred)             
fffff801`47870000 fffff801`478a0000   wfplwfs    (deferred)             
fffff801`478b0000 fffff801`47978000   fvevol     (deferred)             
fffff801`47980000 fffff801`4798b000   volume     (deferred)             
fffff801`47990000 fffff801`479fd000   volsnap    (deferred)             
fffff801`47a00000 fffff801`47aa0000   USBXHCI    (deferred)             
fffff801`47ab0000 fffff801`47ad5000   USBSTOR    (deferred)             
fffff801`47ae0000 fffff801`47af8000   uaspstor   (deferred)             
fffff801`47b00000 fffff801`47b1e000   sdstor     (deferred)             
fffff801`47b20000 fffff801`47b70000   rdyboost   (deferred)             
fffff801`47b80000 fffff801`47ba6000   mup        (deferred)             
fffff801`47bb0000 fffff801`47bc2000   iorate     (deferred)             
fffff801`47bd0000 fffff801`47be0000   hwpolicy   (deferred)             
fffff801`47bf0000 fffff801`47c0c000   disk       (deferred)             
fffff801`47c10000 fffff801`47c7d000   CLASSPNP   (deferred)             
fffff801`48200000 fffff801`48215000   filecrypt   (deferred)             
fffff801`48220000 fffff801`4822e000   tbs        (deferred)             
fffff801`48230000 fffff801`4823a000   Null       (deferred)             
fffff801`48240000 fffff801`4824a000   Beep       (deferred)             
fffff801`48250000 fffff801`48260000   vmrawdsk   (deferred)             
fffff801`48270000 fffff801`482cc000   udfs       (deferred)             
fffff801`48300000 fffff801`4831e000   crashdmp   (deferred)             
fffff801`48320000 fffff801`4833f000   dump_lsi_sas   (deferred)             
fffff801`48360000 fffff801`4837d000   dump_dumpfve   (deferred)             
fffff801`483c0000 fffff801`483f0000   cdrom      (deferred)             
fffff801`48800000 fffff801`48810000   TDI        (deferred)             
fffff801`48820000 fffff801`4882e000   ws2ifsl    (deferred)             
fffff801`48830000 fffff801`4888c000   netbt      (deferred)             
fffff801`48890000 fffff801`488a3000   afunix     (deferred)             
fffff801`488b0000 fffff801`48956000   afd        (deferred)             
fffff801`48960000 fffff801`48973000   npcap      (deferred)             
fffff801`48980000 fffff801`4899a000   vwififlt   (deferred)             
fffff801`489a0000 fffff801`489cb000   pacer      (deferred)             
fffff801`489d0000 fffff801`489e4000   ndiscap    (deferred)             
fffff801`489f0000 fffff801`48a04000   netbios    (deferred)             
fffff801`48a10000 fffff801`48ab1000   Vid        (deferred)             
fffff801`48ac0000 fffff801`48ae1000   winhvr     (deferred)             
fffff801`48af0000 fffff801`48b6b000   rdbss      (deferred)             
fffff801`48b70000 fffff801`48c07000   csc        (deferred)             
fffff801`48c10000 fffff801`48c22000   nsiproxy   (deferred)             
fffff801`48c30000 fffff801`48c3e000   npsvctrig   (deferred)             
fffff801`48c40000 fffff801`48c50000   mssmbios   (deferred)             
fffff801`48c60000 fffff801`48c6a000   gpuenergydrv   (deferred)             
fffff801`48c70000 fffff801`48c9c000   dfsc       (deferred)             
fffff801`48cc0000 fffff801`48d2c000   fastfat    (deferred)             
fffff801`48d30000 fffff801`48d47000   bam        (deferred)             
fffff801`48d50000 fffff801`48d9e000   ahcache    (deferred)             
fffff801`48da0000 fffff801`48db2000   CompositeBus   (deferred)             
fffff801`48dc0000 fffff801`48dcd000   kdnic      (deferred)             
fffff801`48dd0000 fffff801`48de5000   umbus      (deferred)             
fffff801`48df0000 fffff801`48e11000   i8042prt   (deferred)             
fffff801`48e20000 fffff801`48e34000   kbdclass   (deferred)             
fffff801`48e40000 fffff801`48e49000   vmmouse    (deferred)             
fffff801`48e50000 fffff801`48e63000   mouclass   (deferred)             
fffff801`48e70000 fffff801`48e8c000   serial     (deferred)             
fffff801`48e90000 fffff801`48e9f000   serenum    (deferred)             
fffff801`48ea0000 fffff801`48eaa000   vm3dmp_loader   (deferred)             
fffff801`48eb0000 fffff801`48efb000   vm3dmp     (deferred)             
fffff801`48f00000 fffff801`48f10000   usbuhci    (deferred)             
fffff801`48f30000 fffff801`48f59000   HDAudBus   (deferred)             
fffff801`48f60000 fffff801`48fc6000   portcls    (deferred)             
fffff801`48fd0000 fffff801`48ff1000   drmk       (deferred)             
fffff801`49000000 fffff801`49076000   ks         (deferred)             
fffff801`49090000 fffff801`4911e000   e1i65x64   (deferred)             
fffff801`49130000 fffff801`4913b000   vmgencounter   (deferred)             
fffff801`49140000 fffff801`4914f000   CmBatt     (deferred)             
fffff801`49150000 fffff801`49160000   BATTC      (deferred)             
fffff801`49170000 fffff801`491b0000   intelppm   (deferred)             
fffff801`491c0000 fffff801`491cd000   NdisVirtualBus   (deferred)             
fffff801`491d0000 fffff801`491dc000   swenum     (deferred)             
fffff801`491e0000 fffff801`491ee000   rdpbus     (deferred)             
fffff801`491f0000 fffff801`491fe000   USBPcap    (deferred)             
fffff801`49200000 fffff801`4926f000   HdAudio    (deferred)             
fffff801`49270000 fffff801`4927f000   ksthunk    (deferred)             
fffff801`49280000 fffff801`49292000   hidusb     (deferred)             
fffff801`492a0000 fffff801`492df000   HIDCLASS   (deferred)             
fffff801`492e0000 fffff801`492f3000   HIDPARSE   (deferred)             
fffff801`49300000 fffff801`49310000   mouhid     (deferred)             
fffff801`49320000 fffff801`49329000   vmusbmouse   (deferred)             
fffff801`49340000 fffff801`4934e000   dump_diskdump   (deferred)             
fffff801`49350000 fffff801`496fa000   dxgkrnl    (deferred)             
fffff801`49700000 fffff801`49718000   watchdog   (deferred)             
fffff801`49720000 fffff801`49736000   BasicDisplay   (deferred)             
fffff801`49740000 fffff801`49751000   BasicRender   (deferred)             
fffff801`49760000 fffff801`4977c000   Npfs       (deferred)             
fffff801`49780000 fffff801`49791000   Msfs       (deferred)             
fffff801`497a0000 fffff801`497be000   CimFS      (deferred)             
fffff801`497c0000 fffff801`497e2000   tdx        (deferred)

I then change the context to the process with .process /i ffffd88c774b70c0 and set a breakpoint on ntdll!ntcreatefile

Problem is, I wanted to step INTO syscall but upon pressing p windbg executes it without stepping into it, what gives? I'm running running a kernel debugger and debugging a VM, so I should be able to do this, what's the problem here?

blabb · Accepted Answer · 2021-11-20 22:04:05Z

If windbg has broken on ntdll!NtCreateFile and you issue a p or t it should Single step properly
it will execute the syscall inside ntdll!NtCreateFile in a single Step see below

0: kd> g
Breakpoint 0 hit
ntdll!NtCreateFile:
0033:00007ff9`7fcf0100 4c8bd1          mov     r10,rcx
0: kd> p
ntdll!NtCreateFile+0x3:
0033:00007ff9`7fcf0103 b855000000      mov     eax,55h
0: kd> p
ntdll!NtCreateFile+0x8:
0033:00007ff9`7fcf0108 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
0: kd> p
ntdll!NtCreateFile+0x10:
0033:00007ff9`7fcf0110 7503            jne     ntdll!NtCreateFile+0x15 (00007ff9`7fcf0115)
0: kd> p
ntdll!NtCreateFile+0x12:
0033:00007ff9`7fcf0112 0f05            syscall
0: kd> k2
 # Child-SP          RetAddr           Call Site
00 0000003f`e10ac5e8 00007ff9`7bd5e5d6 ntdll!NtCreateFile+0x12
01 0000003f`e10ac5f0 00007ff9`7bd5e2c6 KERNELBASE!CreateFileInternal+0x2f6
0: kd> p
ntdll!NtCreateFile+0x14:
0033:00007ff9`7fcf0114 c3              ret
0: kd> p
KERNELBASE!CreateFileInternal+0x2f6:
0033:00007ff9`7bd5e5d6 0f1f440000      nop     dword ptr [rax+rax]

from your query it is not clear what you are doing
what is the relevance of lm to .process command ??

if you need to single step inside the kernel part you need to have a breakpoint on the actual implementation of ntdll!NtCreateFile in the executive

set a process specific breakpoint on both ntdll!NtCreateFile and nt!NtCreateFile

either a p (step over ) or t (step in ) should break on the kernel part

also notepad.exe is not a good target for practicing if I recall correctly it uses memory mapped operations instead of opening

anyway shown below is a simple demo of breaking on user part and single stepping into kernel part on notepad.exe for file->open from menu (this will trigger the break on NtCreateFile )

look for specific binary (notepad.exe in your case and set process specific breakpoint on user stub in ntdll and executive implementation on kernel.

1: kd> $$ look for relevent process
1: kd> !process 0 0 notepad.exe
PROCESS ffffc50d96c97080
    SessionId: 1  Cid: 10a0    Peb: 3fe1263000  ParentCid: 1008
    DirBase: 1e3c0002  ObjectTable: ffff8787c380b700  HandleCount: 568.
    Image: notepad.exe

1: kd> bp /p ffffc50d96c97080 ntdll!NtCreateFile
1: kd> bp /p ffffc50d96c97080 nt!NtCreateFile
1: kd> bl
     0 e Disable Clear  00007ff9`7fcf0100     0001 (0001) ntdll!NtCreateFile
     Match process data ffffc50d`96c97080
     1 e Disable Clear  fffff800`4f8914e0     0001 (0001) nt!NtCreateFile
     Match process data ffffc50d`96c97080

execute and let the target run using g

now in side the target use File->open on the open binary instance (notepad.exe in your case)
the breakpoint on notepad.exe in ntdll should be hit with a call stack thus

(be aware you need a proper symbol path and cache of pdbs and you should have issued .reload /f now or prior to calling k for a proper call stack display)

Notice the InvokeOpenDialog() in notepad.exe this triggers the break further up on ntdll!NtCreatFile

1: kd> g
Breakpoint 0 hit
ntdll!NtCreateFile:
0033:00007ff9`7fcf0100 4c8bd1          mov     r10,rcx
1: kd> k
 # Child-SP          RetAddr           Call Site
00 0000003f`e10acaa8 00007ff9`7bd5e5d6 ntdll!NtCreateFile
01 0000003f`e10acab0 00007ff9`7bd5e2c6 KERNELBASE!CreateFileInternal+0x2f6
02 0000003f`e10acc20 00007ff9`7bd5cc21 KERNELBASE!CreateFileW+0x66
03 0000003f`e10acc80 00007ff9`7bd5edc0 KERNELBASE!BasepLoadLibraryAsDataFileInternal+0x291
04 0000003f`e10aceb0 00007ff9`7d912010 KERNELBASE!LoadLibraryExW+0xe0
05 0000003f`e10acf20 00007ff9`7d90fdee SHELL32!GetShellStyleHInstance+0xc8
06 0000003f`e10ad250 00007ff9`7d93d3a4 SHELL32!UpdateStyle+0x1e
07 0000003f`e10ad290 00007ff9`7d93cece SHELL32!DUI_ShellStyleSheet_InitProcess+0x94
08 0000003f`e10ad2d0 00007ff9`7d908ed7 SHELL32!InitializeDirectUI+0x32
09 0000003f`e10ad300 00007ff9`7d981320 SHELL32!CDUIViewFrame::CreateFrameWindow+0x37
0a 0000003f`e10ad360 00007ff9`7d97fc8c SHELL32!CreateViewFrame+0x8c
0b 0000003f`e10ad3d0 00007ff9`7d97fb2c SHELL32!CExplorerBrowser::_SwitchView+0xc0
0c 0000003f`e10ad4a0 00007ff9`7d97f10f SHELL32!CExplorerBrowser::_BrowseToView+0x204
0d 0000003f`e10ad540 00007ff9`7d97ede3 SHELL32!CExplorerBrowser::_BrowseObjectInternal+0xef
0e 0000003f`e10ad5c0 00007ff9`7d97e330 SHELL32!CExplorerBrowser::_OnBrowseObject+0x37
0f 0000003f`e10ad5f0 00007ff9`7cfb5b83 SHELL32!CExplorerBrowser::BrowseObject+0xb0
10 0000003f`e10ad6f0 00007ff9`7cfbd43f COMDLG32!CFileOpenSave::_JumpToInitialLocation+0x1c3
11 0000003f`e10ad780 00007ff9`7cfc9cbe COMDLG32!CFileOpenSave::_InitOpenSaveDialog+0x191f
12 0000003f`e10ae200 00007ff9`7fa8e9cf COMDLG32!CFileOpenSave::s_OpenSaveDlgProc+0x68e
13 0000003f`e10ae4a0 00007ff9`7fa87d62 USER32!UserCallDlgProcCheckWow+0x197
14 0000003f`e10ae580 00007ff9`7fa87c76 USER32!DefDlgProcWorker+0xd2
15 0000003f`e10ae640 00007ff9`7fa8ca66 USER32!DefDlgProcW+0x36
16 0000003f`e10ae680 00007ff9`7fa8c0b8 USER32!UserCallWinProcCheckWow+0x266
17 0000003f`e10ae800 00007ff9`7fa8fa5e USER32!SendMessageWorker+0x218
18 0000003f`e10ae8a0 00007ff9`7faaf61a USER32!InternalCreateDialog+0xa2e
19 0000003f`e10aea80 00007ff9`7faaf4f2 USER32!InternalDialogBox+0x106
1a 0000003f`e10aeae0 00007ff9`7faaf488 USER32!DialogBoxIndirectParamAorW+0x52
1b 0000003f`e10aeb20 00007ff9`7cfd84de USER32!DialogBoxIndirectParamW+0x18
1c 0000003f`e10aeb60 00007ff9`7cfbe568 COMDLG32!<lambda_772b13dd37a5eaf1da6a98973fbee968>::operator()+0x9e
1d 0000003f`e10aeba0 00007ff6`8ced20ac COMDLG32!CFileOpenSave::Show+0xb08
1e 0000003f`e10af000 00007ff6`8ced226b notepad!ShowOpenSaveDialog+0x104
1f 0000003f`e10af060 00007ff6`8ced2941 notepad!InvokeOpenDialog+0x14f
20 0000003f`e10af0c0 00007ff6`8ced4037 notepad!NPCommand+0x425
21 0000003f`e10af440 00007ff9`7fa8ca66 notepad!NPWndProc+0x5e7
22 0000003f`e10af740 00007ff9`7fa8c582 USER32!UserCallWinProcCheckWow+0x266
23 0000003f`e10af8c0 00007ff6`8ced448d USER32!DispatchMessageWorker+0x1b2
24 0000003f`e10af940 00007ff6`8ceeae07 notepad!WinMain+0x255
25 0000003f`e10afa40 00007ff9`7d5b81f4 notepad!__mainCRTStartup+0x19f
26 0000003f`e10afb00 00007ff9`7fcba251 KERNEL32!BaseThreadInitThunk+0x14
27 0000003f`e10afb30 00000000`00000000 ntdll!RtlUserThreadStart+0x21

now you can single step up to syscall with either p or t (I am using pc to step unto next call as i have pasted the instructions above) and on executing the syscall your break on the executive (nt) should be hit.

happy tracing :)

1: kd> p
ntdll!NtCreateFile+0x3:
0033:00007ff9`7fcf0103 b855000000      mov     eax,55h
1: kd> pc
ntdll!NtCreateFile+0x12:
0033:00007ff9`7fcf0112 0f05            syscall
1: kd> t
Breakpoint 1 hit
nt!NtCreateFile:
fffff800`4f8914e0 4881ec88000000  sub     rsp,88h
1: kd> k4
 # Child-SP          RetAddr           Call Site
00 ffff8386`4a667a88 fffff800`4f467785 nt!NtCreateFile
01 ffff8386`4a667a90 00007ff9`7fcf0114 nt!KiSystemServiceCopyEnd+0x25
02 0000003f`e10acaa8 00007ff9`7bd5e5d6 ntdll!NtCreateFile+0x14
03 0000003f`e10acab0 00007ff9`7bd5e2c6 KERNELBASE!CreateFileInternal+0x2f6
1: kd> !obja @r8
Obja +0000000000000000 at 0000003fe10acb78:
    Name is \??\C:\Windows\resources\themes\Aero\Shell\NormalColor\ShellStyle.dll
    OBJ_CASE_INSENSITIVE

1: kd> ?? (char *)((nt!_EPROCESS *)@$proc)->ImageFileName
char * 0xffffc50d`96c974d0
 "notepad.exe"

ok, I think I didn't explain it, but I wanted to step thru KiSystemCall64 and other functions that will eventually lead to nt!CreateFile or whatever. So instead of the trace ntdll!NtCreateFile -> nt!KiSystemServiceCopyEnd -> nt!NtCreateFile, I'd want something like ntdll!NtCreateFile -> KiSystemCall64 -> ... -> nt!NtCreateFile, how do I do it? — Alexey, Commented Nov 21, 2021 at 22:35

Igor Skochinsky · Accepted Answer · 2021-11-20 11:37:50Z

1

From the documentation:

When subroutine calls or interrupts occur, they are treated as a single step.

So it seems the syscall is treated as “interrupt” or a function call. You probably need to use t (trace) to step into it.

answered Nov 20, 2021 at 11:37

Igor Skochinsky♦

36.9k7 gold badges65 silver badges116 bronze badges

Add a comment |

Stack Exchange Network

Why windbg skips syscall on kernel mode?

2 Answers 2

Your Answer

Not the answer you're looking for? Browse other questions tagged
windows
debugging
x86
windbg
kernel-mode
or ask your own question.

Hot Network Questions

Why windbg skips syscall on kernel mode?

2 Answers 2

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged windowsdebuggingx86windbgkernel-mode or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
windows
debugging
x86
windbg
kernel-mode
or ask your own question.