本文主要记录个人安装VMware+Windgb+Win7内核驱动调试的笔记。
一、安装环境
- 主机:Windows Vista Bussiness
- 虚拟机:VMware 7
- GUestOS: Win7
- Windbg: 6.11
二、虚拟机配置
- 打开相应 vmware 虚拟机上的 “Virtaul Machine Settings“
- “Hardware ”选项中 ----> 点击“Add" 添加一个串口设备 SeriallPort .
-
"Next",在 "Serial Port" 里选中 “Output to named pipe"
- "next",然后如下设置:
- 确定之后,回到如下界面,在右脚"Virtual Machine Settings" 页面时,在“I/O Mode” 里选中“Yield CPU on poll“
-
Ok之后就设定完毕了。
三、Windbg设置
四、GuestOS设置
- 在administrator权限下, 进入command line模式,
键入bcdedit命令, 会出现以下界面:
- 然后, 设置端口COM1, baudrate为115200 (除COM1外, 也可以用1394或USB. 1394用起来比COM口快多了, 当然前提是你需要有1394卡及其驱动. 很恶心的是Vista不再支持1394的文件传输协议, 但是用windbg双机调试还是可以的)
命令为:
bcdedit/dbgsettings {serial [baudrate:value][debugport:value] | 1394 [channel:value] | usb }
- 接着, 我们需要复制一个开机选项, 以进入OS的debug模式
命令为:
bcdedit/copy {current} /d DebugEnty
DebugPoint为选项名称, 名字可以自己定义. 然后复制得到的ID号.
- 接着增加一个新的选项到引导菜单
bcdedit/displayorder {current} {ID}
这里的{ID}的ID值是刚生成的ID值.
- 激活DEBUG : bcdedit
/debug {ID} ON
这里的{ID}的ID值还是刚才的ID值.
- 命令执行成功后, 重新启动机器.或者更简单的图形界面设置:在msconfig界面中,选Boot,再选Advanced options,在选择Debug、Debug port、Baud rate都打上钩。如果所示:
- 选择DebugEntry[debug]作为等入口。启动后,打开windbg.可以看到类似如下的信息:
- Microsoft
(R) Windows Debugger Version 6.11.0001.404 X86 - Copyright
(c) Microsoft Corporation. All rights reserved. -
- Opened
\\.\pipe\com_1 - Waiting
to reconnect... - Connected
to Windows 7 7600 x86 compatible target at (Thu Dec 10 17:46:36.928 2009 (GMT+8)), ptr64 FALSE - Kernel
Debugger connection established. (Initial Breakpoint requested) - Symbol
search path is: *** Invalid *** - ****************************************************************************
- *
Symbol loading may be unreliable without a symbol search path. * - *
Use .symfix to have the debugger choose a symbol path. * - *
After setting your symbol path, use .reload to refresh symbol locations. * - ****************************************************************************
- Executable
search path is: - *********************************************************************
- *
Symbols can not be loaded because symbol path is not initialized. * - *
* - *
The Symbol Path can be set by: * - *
using the _NT_SYMBOL_PATH environment variable. * - *
using the -y <symbol_path> argument when starting the debugger. * - *
using .sympath and .sympath+ * - *********************************************************************
- ***
ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe - - Windows
7 Kernel Version 7600 MP (1 procs) Free x86 compatible - Product:
WinNt, suite: TerminalServer SingleUserTS - Built
by: 7600.16385.x86fre.win7_rtm.090713-1255 - Machine
Name: - Kernel
base = 0x83e0f000 PsLoadedModuleList = 0x83f57810 - Debug
session time: Thu Dec 10 17:46:32.658 2009 (GMT+8) - System
Uptime: 0 days 0:06:18.429 - Break
instruction exception - code 80000003 (first chance) - *******************************************************************************
- *
* - *
You are seeing this message because you pressed either * - *
CTRL+C (if you run kd.exe) or, * - *
CTRL+BREAK (if you run WinDBG), * - *
on your debugger machine's keyboard. * - *
* - *
THIS IS NOT A BUG OR A SYSTEM CRASH * - *
* - *
If you did not intend to break into the debugger, press the "g" key, then * - *
press the "Enter" key now. This message might immediately reappear. If it * - *
does, press "g" and "Enter" again. * - *
* - *******************************************************************************
- nt!DbgBreakPointWithStatus+0x4:
- 83e7a394
cc int 3
- Microsoft
五、操作方式提示
- 我发现,如果在GuestOs -win7启动过程中,如果打开了windbg之后,整个系统就像死机,不动了。估计是windbg启动后设定了断点做调试,试试按F5,或者go这样就可以恢复原来的状态。