登录查看更多内容

How do you set breakpoints and watchpoints in kernel debugger for device driver development?

由人工智能和领英社区提供技术支持

If you are developing device drivers for Windows, you may need to use the kernel debugger (KD) to troubleshoot your code, test your logic, and catch errors. KD is a powerful tool that lets you control the execution of the kernel and the driver, examine memory and registers, and set breakpoints and watchpoints. Breakpoints and watchpoints are special instructions that pause the execution of the code when certain conditions are met, such as reaching a specific address, accessing a memory location, or triggering an exception. In this article, you will learn how to set breakpoints and watchpoints in KD for device driver development.

此文章中的业界达人

由社区从 2 条内容中精选。了解更多

Ryan Thompson

Delivery Manager at Apriorit / we’ve been building challenging security software solutions for tech companies since 2002

1 Setting breakpoints

To set a breakpoint in KD, you can use the bp command followed by the address or symbol of the code location where you want to stop the execution. For example, bp nt!IoCreateDevice will set a breakpoint at the beginning of the IoCreateDevice function in the kernel. You can also use the -l option to specify the length of the breakpoint, or the -c option to add a condition that must be true for the breakpoint to trigger. To list all the breakpoints you have set, use the bl command. To delete a breakpoint, use the bc command followed by the breakpoint number.

添加您的观点

Ryan Thompson

Delivery Manager at Apriorit / we’ve been building challenging security software solutions for tech companies since 2002
举报内容
Before you set a breakpoint, it can be useful to find the name of the final function or, if it's a template function, to resolve it. To find all functions from ntdll.dll that contain the "File" string in their names, you can use this command: x ntdll!*File* Also, if you’re unsure which functions will be called, you can use the bm command to set breakpoints to all functions that match a pattern string.

已翻译

赞

2 Setting watchpoints

To set a watchpoint in KD, you can use the ba command followed by the access type, the size, and the address or expression of the memory location you want to monitor. For example, ba w 4 MyDriver!g_data will set a watchpoint that will break the execution when a 4-byte word at the g_data variable in your driver is written to. The access type can be r for read, w for write, or e for execute. The size can be 1, 2, 4, or 8 bytes. You can also use the -c option to add a condition that must be true for the watchpoint to trigger. To list all the watchpoints you have set, use the bl command. To delete a watchpoint, use the bc command followed by the watchpoint number.

添加您的观点

3 Using expressions

One of the advantages of KD is that you can use expressions to specify addresses, symbols, values, or conditions for breakpoints and watchpoints. Expressions can include arithmetic operators, logical operators, relational operators, constants, registers, symbols, and functions. For example, bp MyDriver!MyFunction+0x10 will set a breakpoint at 16 bytes after the start of MyFunction in your driver. You can also use expressions to evaluate values, modify memory, or call functions. For example, ? MyDriver!g_data will display the value of the g_data variable in your driver. To learn more about expressions, use the .help command in KD.

添加您的观点

4 Controlling the execution

Once you have set your breakpoints and watchpoints, you can use KD to control the execution of the kernel and the driver. To start or resume the execution, use the g command. To pause the execution, use the Ctrl+Break key combination. To step into a function call, use the t command. To step over a function call, use the p command. To step out of a function, use the gu command. To display the current context, use the .cxr command. To display the call stack, use the k command. To display or modify registers, use the r command. To display or modify memory, use the db, dw, dd, or dq commands.

添加您的观点

5 Debugging symbols

To make your debugging experience easier and more meaningful, you need to load debugging symbols for the kernel and your driver. Debugging symbols are files that contain information about the names and locations of functions, variables, and data structures in the code. Without debugging symbols, you will only see addresses and raw data in KD. To load debugging symbols, you need to set up a symbol path that points to the location of the symbol files on your disk or on a network server. You can use the .sympath command to set or display the symbol path. You can also use the .reload command to reload the symbols for a specific module or for all modules.

添加您的观点

Ryan Thompson

Delivery Manager at Apriorit / we’ve been building challenging security software solutions for tech companies since 2002
举报内容
In some cases, it may be impossible to resolve debugging symbols because the version of the driver loaded in the memory is different from the one you specified in the .pdb file using the .sympath command. To check this, you need to compare the datetime of your driver/pdb file and the datetime of the loaded driver using this command: lm m <driver_name> v In such cases, you can force the loading of debugging symbols using the .reload command with the ignore option: .reload /i <driver_name.sys>

已翻译

赞

6 Troubleshooting tips

If you encounter any problems or errors while using KD, here are some tips to help you resolve them. First, make sure you have configured your target and host computers correctly for kernel debugging. You can use the .kdfiles command to verify the debugging settings and check the connection status. Second, make sure you have the latest version of KD and the Windows Driver Kit (WDK) installed on your host computer. You can use the .version command to display the version information of KD and the WDK. Third, make sure you have the correct and matching debugging symbols for the kernel and your driver. You can use the lm command to list the loaded modules and their symbol status.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Device Drivers

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you set breakpoints and watchpoints in kernel debugger for device driver development?

1

2

3

4

5

6

7

1 Setting breakpoints

2 Setting watchpoints

3 Using expressions

4 Controlling the execution

5 Debugging symbols

6 Troubleshooting tips

7 Here’s what else to consider

Device Drivers

给文章评分

感谢您的反馈

更多Device Drivers相关文章

更多相关阅读内容