Debugview를 사용하여 원격 커널 로그 보기

원격호스트의 커널로그를 보기 위해서는  다음과 같은 방법이 있다.

1. Windbg 를 사용하여 커널 디버깅 설정
2. Debugview를  원격 로그 설정

1번의 Windbg를 통해 디버깅을 하면 브레이트 포인트/로컬 변수확인 등 여러가지가 가능하지만 무겁고 설정또한 쉽지 않다. (Windbg를 통한 디버깅 바로가기)

따라서 로그만을 확인할 경우는 Debugview를 사용하여 원격 호스트의 로그만을 확인하는 것이 좋다.

Debugview는 서버- 에이전트 방식으로 뷰어에 원격지 로그 정보를 제공한다.

1. 우선 debugview를 다운 받는다.(바로가기)
2.  다운받은 debugview를 로그를 확인할 호스트와, 디버깅할 호스트에 각각 설치한다.
3. 디버깅할 호스트에서 cmd 창을 열어 ,다음 명령을 실행한다.
   (windows key+r 입력후 cmd를 입력한후 엔터를 치면 cmd창이 실행된다)
   
   
   

   dbgview /a /k /v

   * 각 옵션은 agent 모드 실행,  커널로그 캡처, 상세로그출력이며 상세한 사항은 다음과 같다.
   
   
   명령이 정상 실행 되면 조그만 debugview 창이 뜨면서 접속을 대기한다는 메세지가 나온다, 창을 출력하고 싶지 않을경우 /t 옵션을 추가 하면 된다.
   
4. 로그를 출력할 호스트에서 dbgview를 더블 클릭하여 실행한다.
   프로그램 화면의 메뉴에서 COMPUTER> CONNECT를 선택한후,  호스트의 호스트 이름 혹은 IP를 입력한다. 
5. 로그를 출력할 호스트의  화면에서는 메뉴의 CAPTURE>CAPTURE KERNEL이 꺼져 있으므로 켜준다.

     위 과정을  완료하면  커널 로그가 출력된다.

     하지만 windbg보다 빠를 뿐, 만족할 만한 속도가 나오지 않는다.

애매한 사용성이지만  누구가 쉽게 접근하여 설정/사용이 가능하다는 장점이 있다.

WinDbg Shortcut custermizing

WinDbg Shortcut custermizing for Kernel debugging

When we do a kernel debugging, Everytime, to type a sort of evirnoment settings such like port, keys, symbos and etc is very hard works and inconvenient.

So, you can make a shutcut to start winbg with that's all inconvenien.

Steps

1. You can copy link file to your own path.
2. Do right click > go on 'shortcut tab' 
3. Copy and paste to target values with next example.
   
   
   In case of using networks.
   

   "C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\windbg.exe" -y cache*c:\symbols;SRV*http://msdl.microsoft.com/download/symbols -k net:port=60000,key=suln6kbqs6x6.37m1nwn9s7hax.1nidtg54nvhxf.21ntp6ltnme6m

   
   
   In case of using serial port.
   

   "C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\windbg.exe" -y cache*c:\symbols;SRV*http://msdl.microsoft.com/download/symbols -k com:pipe,port=\\.\pipe\com_2008_0,resets=1,reconnect -c ".echotimestamps 1"

4. And, update your own parameters, for example. symbol's path, key, port and so on.

Good luck!

The dbgPrint or kdprint don't work appearing message in windbg

The dbgPrint or kdprint don't work appearing message in windbg

Preinstalled

OS : Windows 2012 R2

Cause:

Higher version of the windows than the vista , DbgPrint and KdPrint is mapped each DbgPrintEx, KdPrintEx automatically.

At this timing, DbgPrintEx will be called with Parameter 'DFLTR_INFO_LEVEL'. and, Which has 0x3 value meaning to print limited as default .

Solution:

1. Temporarily, you can run to fix ti with command
   
   

   kd > ed Kd_DEFAULT_MASK 8

   
   And , Each number means next....
   
   #define DPFLTR_ERROR_LEVEL 0
   #define DPFLTR_WARNING_LEVEL 1
   #define DPFLTR_TRACE_LEVEL 2
   #define DPFLTR_INFO_LEVEL 3
   #define DPFLTR_MASK 0x80000000
2. If you want to fix it permanently....
   
   

   KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\

   
   If the key 'Debug Print Filter' is not in there , add the key ,else change values as 0xF.
3. If there is not a dword of type named 'DEFAULT' , add it  with value f by yourself.
   
   

※ Reference : https://msdn.microsoft.com/en-us/library/ff551519.aspx

Basis of windows kernel debugging

Windows Driver Debugging with WinDbg.

Window Memory architecure

<fig  32 bit windows memory archtecture>

windows kernel debugging model

<fig  windows kernerl debugging model>

Debugging types

User mode debugging

It is debugging a process that is started on user mode.

by visual studio , windbg

Kernel mode debugging

It is debugging a process that is started on Kernel mode.

by windbg

live debugging

it is debugging a process that is running step by step each line of source.

dump debugging

It is a analying dump when is created at the system crash or blue screen.

Terms

user dump

It is a dump on the user mode.

kernel dump

It is a dump on the kernel mode.

the debugger

It means  a something installed tools for debugging.

the debugee

it means  target like  processes or drivers will be  debugged.

Debug Symbols

such as a  pdb files

it includes function, variablable’s name and location and source line.

Stack

In x86 arch , The register ESP, EBP invloves meaning of the stack’s start and stop address.

Command Prompt

0:000>  - The first part of ‘0’ being means process number. and, The left ‘000’  part is thread number

kd> - The kernel mode command prompt.

0: kd >  The front ‘0’ is the Processor( means cpu ) number. and ‘kd’ means being that is in kernel mode.

windbg commands

Debugger Commands

• r - register - Display cpu resister information.
• k - call stack - Show call stack backtrace
• g - go - keep going kernel
• p - pause - pause step
• pc - - Step to next call
• t - trace -
• tb - - trace to next branch
• tc - - trace to next call
• wt - - Trace and watch data
• a - assemble
• u - unassemble
• bc - breakpoint cleaar
• bd - breakpoit disable
• be - breakpoit enable
• bl - breakpoit list
• ba - break on access
• d , da, db, dw, dd - display - display memory
• dds - - display word and symbol
• dl - - display linked list
• ds - - Display string
• dt - - Display type
• dv - - Display local variable
• s - - Search memory
• ls - - load symbol
• lm - - list loaded symbol
• ln - - list nearest symbol
• k, kb, kd, kp, kv - - display stack backtrace
• e, ea, ed, ed, ew, eu - enter - enter values
• etc...

Meta Commands

• .sympath - Set symbol path
• .reload - Reload module
• .srcpath - set source path
• .exepath - Set executable path
• .trap - Display trap frame
• .ecxr - Display exception context record
• .exr - Display exception record
• .cxr - Display context record
• .reboot - reboot target compter
• .dump - Create dump file
• .enable_uncode - Enable unicode display
• .ofilter - Filter target output
• .cls - clear screen
• .bugcheck - Display bug check data
• .context - Set user mode address context
• .process -Set process context
• .thread - Set register context
• .tss - display Task stte segment
• .load - Load extension dll
• etc...

Extension Commands

• !anlyze - Displays information about the current bug check
• !cpuid - Displays information about the prosessors on the system
• !error - Decodes and displays information about an error value
• !gle - Displays the last error value for the current thread
• !obja - Displays the attributes of an oobject in the object manager
• !peb - D!peb - Display a fomattes view of the information in the processs environment block (PEB)
• !teb - Display a fomatted view of the information in the thread environment block (PEB)
• !token - Display a formatted view of a security token object
• !process - Displays information about the specified process or all
• !stacks - Display a information about a current kernel stacks
• !thread - Displays summary information about a thread
• !zombies - Displays all dead “zombie”  processes or thread
• !drivers - Displays  list of all drivers loaded
• !devnote - Displays a formatted view of the device stack
• !devobj -Displays detailed information about a DEVICE_OBJECT
• !devstack - Displays a formatted view of the device stack
• !drvobj -Displays detailed information about a DRIVER_OBJET
• etc..

How to Windows Kernel debugging between Virtual marchine with Network

How to Windows Kernel debugging between Virtual marchine with Network .

Test Setting Debugger and Debugee have same settings. Windows 2012 R2 Visual Studio 2013 WDK 8.1 1 - NIC

Basically, Kernel debugging dodel is a diagram that is following <fig .1>.

<fig .1>

Therefore, It needs 2 PCs or 2 VMs for debugging, and it has to be connected by Network  each o other.

And, Network kernel debugging is suppored by WDK 8 and later..

However, Despite of Supprting formally, From the ‘msconfig’ GUI wizard , it does not choose ‘NET’ mode…

ㅜ.,ㅜ….

But, It became more simpler than using a serial port.

hoooray~.

Steps for the Debuggee

1. Setting up the debug mode with a network address , then Run commands next..

bcdedit /debug on bcdedit /dbgsettings net hostip:192.168.2.8 port :50000 ※  A parameter hostip means address of ‘Debugger’ that is connected with ‘Debugee’. ※ A command returns Key and you should to note or rememeber that key. ※ And, you are going to see your debug settings with following command. (bcdedit /dbgsettings)

2. and Reboot

Steps for The Debugger

1. Start  a Windbg.
2. Click on the File > ‘Kernel Debug’
3. Move on ‘NET’ tab of the popup window.
4. Enter value of  port and Key you memo. ( ex . sdkjhs8sjhdksjd87sdjhksjdnnjhskd9sdks)
5. Click ‘OK’
6. It will printed “Waiting connect..” .
   
   If it still connecting…
   
7. Reboot debuggee , and click on the Debug > break .
   
   After it is connected, you want to boot debugee continually.
   
8. Click on the Debug > go.

How to start Windows Kernel debugging on Virtual marchine with Serial port

How to start Windows Kernel debugging on Virtual marchine with Serial port .

Test Setting Debugger and Debugee have same settings. Windows 2012 R2 Visual Studio 2013 WDK 8.1 1 NIC 1 Serial port

Basically, Kernel debugging dodel is a diagram that is following <fig .1>.

<fig .1>

Therefore, It needs 2 PC for debugging.

Steps for the Debuggee

In other word, Debuggee is called “Target PC”.

1. Power off  the VM (debuggee).
2. VM Workstation > Setting> click ‘add…’ > click ‘Serial port’
3. Choose ‘Named Pipe’ and Enter a pipe name with format. ( ex ‘\\.\pipe\debug’)
4. Choose “this is … server “ for the near end.
5. Choose “this is … Application” for the Far end.
6. Dselect the “Yield on CPU Poll” on the check box
7. Click ‘ok’ ( Remeber new added serial Port Number )
8. Power on the VM.
   
   After booting
   
9. Open ‘Device Manager’
10. Expand the ports that is tree item.
11. Confirm the new serial port  that you added is working nomally.
    (Recommend to use view menu ‘hidden device show’.
12. Check the Properties if it is corrent value or not when you had added a new serial port.
13. Setting up the debug mode with a serial port you made before a step.

bcdedit /debug on bcdedit /dbgsettings serial debugport:2 baudrate:115200 ※ And, you can see your debug settings with following command. (bcdedit /dbgsettings)

14. and Reboot.

Steps for The Debugger

1. Start  a Windbg.
2. Click on the File > ‘Kernel Debug’
3. Move on ‘COM’ tab of the popup window.
4. Enter value a pipe name on port. ( ex ‘\\.\pipe\debug’ - you entered before )
5. Select the ‘pipe’ check box, then click ‘OK’
6. It will printed “Waiting connect..” .
   
   If it still connecting…
   
7. Reboot debuggee , and click on the Debug > break .
   
   After it is connected, you want to boot debugee continually.
   
8. Click on the Debug > go.