windbg驅(qū)動(dòng)調(diào)試

1、本文主要記錄個(gè)人安裝VMware+Windgb+Win7內(nèi)核驅(qū)動(dòng)調(diào)試的筆記。一、安裝環(huán)境1 主機(jī)：Windows Vista Bussiness2 虛擬機(jī)：VMware 73 GUestOS: Win74 Windbg: 6.11 二、虛擬機(jī)配置打開相應(yīng) vmware 虛擬機(jī)上的 “Virtaul Machine Settings“2.“Hardware”選項(xiàng)中 - 點(diǎn)擊“Add”添加一個(gè)串口設(shè)備 SeriallPort .3.”Next”,在 “Serial Port” 里選中 “Output to named pipe”4.”next”,然后如下設(shè)置：5.確定之后，回到如下界面，在右腳”V

2、irtual Machine Settings” 頁面時(shí)，在“I/O Mode” 里選中“Yield CPU on poll“6. Ok之后就設(shè)定完畢了。三、Windbg設(shè)置下載地址： Windbg安裝之后，設(shè)置一個(gè)桌面快捷方式，然后，右鍵-屬性，在Target中的引號(hào)后面添加如下：-b -k com:pipe,port=.pipecom_1,resets=0或者是： -b -k com:port=.pipecom_1,baud=115200,pipe 【二者似乎皆可】四、GuestOS設(shè)置Vista和XP不同, 沒有boot.ini文件, 需要用bcdedit進(jìn)行啟動(dòng)設(shè)置。1. 在admin

3、istrator權(quán)限下, 進(jìn)入command line模式, 鍵入bcdedit命令, 會(huì)出現(xiàn)以下界面:2. 然后, 設(shè)置端口COM1, baudrate為115200 (除COM1外, 也可以用1394或USB. 1394用起來比COM口快多了, 當(dāng)然前提是你需要有1394卡及其驅(qū)動(dòng). 很惡心的是Vista不再支持1394的文件傳輸協(xié)議, 但是用windbg雙機(jī)調(diào)試還是可以的)命令為:bcdedit /dbgsettings serial baudrate:valuedebugport:value | 1394 channel:value | usb 3.接著, 我們需要復(fù)制一個(gè)開機(jī)選項(xiàng),

4、以進(jìn)入OS的debug模式命令為:bcdedit /copy current /d DebugEntyDebugPoint 為選項(xiàng)名稱, 名字可以自己定義. 然后復(fù)制得到的ID號(hào).4. 接著增加一個(gè)新的選項(xiàng)到引導(dǎo)菜單bcdedit /displayorder current ID這里的ID的ID值是剛 生成的ID值.5. 激活DEBUG : bcdedit /debug ID ON這里的ID 的ID值還是剛才的ID值.6. 命令執(zhí)行成功后, 重新啟動(dòng)機(jī)器.或者更簡單的圖形界面設(shè)置：在msconfig界面中，選Boot,再選Advanced options，在選擇Debug、Debug port

5、、Baud rate都打上鉤。如果所示：7. 選擇DebugEntrydebug作為等入口。啟動(dòng)后，打開windbg.可以看到類似如下的信息：Microsoft (R) Windows Debugger Version 6.11.0001.404 X86Copyright (c) Microsoft Corporation. All rights reserved.Opened .pipecom_1Waiting to reconnectConnected to Windows 7 7600 x86 compatible target at (Thu Dec 10 17:46:36.928 2

6、009 (GMT+8), ptr64 FALSEKernel Debugger connection established. (Initial Breakpoint requested)Symbol search path is: * Invalid * Symbol loading may be unreliable without a symbol search path. * Use .symfix to have the debugger choose a symbol path. * After setting your symbol path, use .reload to re

7、fresh symbol locations. *Executable search path is:* Symbols can not be loaded because symbol path is not initialized. * * The Symbol Path can be set by: * using the _NT_SYMBOL_PATH environment variable. * using the -y argument when starting the debugger. * using .sympath and .sympath+ * ERROR: Symb

8、ol file could not be found. Defaulted to export symbols for ntkrpamp.exe -Windows 7 Kernel Version 7600 MP (1 procs) Free x86 compatibleProduct: WinNt, suite: TerminalServer SingleUserTSBuilt by: 7600.16385.x86fre.win7_rtm.090713-1255Machine Name:Kernel base = 0x83e0f000 PsLoadedModuleList = 0x83f57

9、810Debug session time: Thu Dec 10 17:46:32.658 2009 (GMT+8)System Uptime: 0 days 0:06:18.429Break instruction exception code 80000003 (first chance)* * You are seeing this message because you pressed either * CTRL+C (if you run kd.exe) or, * CTRL+BREAK (if you run WinDBG), * on your debugger machines keyboard. * * THIS IS NOT A BUG OR A SYSTEM CRASH * * If you did not intend to break into the debugger, press the “g” key, then * press the “Enter” key now. This message might immediately reappear. If it * does, press “g” and “Enter” again. * *