登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

lgjmfyx的博客

享受生活每一天

 
 
 

日志

 
 

在vmware上使用windbg进行双机内核调试  

2008-12-01 21:57:17|  分类: 技术技巧 |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |
在vmware上使用windbg进行双机内核调试
2007-07-24 21:50
Driver Debugging with WinDbg and VMWare

One of the first useful things you will want to do when in the bowels of ring 0 is attack the thing from a debugger point of view. In my case I like using Windows Debugger [windbg] (hey its free, fully functional and does remote debugging really well), and found it neccessary to find a way to have it work with VMWare.

The trick to get it to work in VMWare is to get the host OS to believe it is able to connect to a serial port. Through VMWare, to accomplish this, you need to create a named pipe. The following steps will guide you to configuring VMWare (in my case v3.2):

Open up the Configuration Editor (Settings->Configuration Editor) Select Serial Port, and then click the Next button

在vmware上使用windbg进行双机内核调试 - lgjmfyx - lgjmfyx的博客

Use the default pipe name. It SHOULD be \\.\pipe\com_1. If it is not, change it to that. Select the Yield CPU on poll checkbox

在vmware上使用windbg进行双机内核调试 - lgjmfyx - lgjmfyx的博客

This is an important step as the Kernel in the target virtual machine uses the port in polled mode, not interrupt mode.

Click the Finish button, and then click Ok to close the Configuration Editor.

Once you have configured your VMWare session, you need to power it on. You will be able to confirm that the new virtual serial port is added by clicking on the Devices->serial0 menu item. You should note it is saying "Connecting". This means its now ready for a remote connection.

Once the actual virtual machine is configured, you need to configure the target operating system installed in the virtual machine to support remote debugging. This is accomplished by editing the boot.ini found in the root of the C:\ drive. To do this, you need to add a /debugport=some_com_port /baudrate=some_baud_rate to the end of an [operating systems] line. I would not recommend doing it to the one that is there. It would be better to copy the line and paste it with the ammendments, and then use the OS's menu selection to determine which mode you would like to boot into. This is what my boot.ini looks like for XP Pro as the operating system in the virtual machine:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional - Debug" /fastdetect /debugport=com1 /baudrate=115200

You will notice that the second option sets the debugport to com1, and sets the baudrate to 115200. I am told you can tweak this out to get even more speed out. But it seems fine for me at this speed, so I haven't mucked with it at all. If you do try this, drop me an email and let me know how it works out.

If you set up your boot.ini fine, save it and reboot. You should be prompted with something that looks like this:

在vmware上使用windbg进行双机内核调试 - lgjmfyx - lgjmfyx的博客

At this point you have completed setting up the VMWare side of things. Now you need to set up the host to connect to it. This is actually rather easy. You just need to tell windbg at the command like to connect to the pipe, like this:

windbg -k com:port=\\.\pipe\com_1,pipe If you are using WinDbg 6.x or newer, a better alternative is to use: windbg -b -k com:pipe,port=\\.\pipe\com_1,resets=0

Thanks needs to go to for pointing out the new format for the latest Windbg version.

I am a rather anal type guy when it comes to security, so I actually made a shortcut on my desktop to WinDbg and added these command line arguments to the Target line. Originally this was so I could run WinDbg with differnet credentials as I do not run with administrator privileges on a day to day basis. I found that with XP's normal security settings for com ports, you can still work in a least privileged environment while doing the development WITHOUT having to use 'runas'. (You are logged into W2K/XP as a least priviledged environment aren't you? If not, you really should read my article on how, and why this is important to do so.)

At this point fire up the debugger. With any luck you should see something that looks like this:

在vmware上使用windbg进行双机内核调试 - lgjmfyx - lgjmfyx的博客

If you are using a WinDbg version earlier than 6.x, you will find one issue with this approach. If you cannot seem to connect right away, close Windbg and restart it... it will then work. Seems flaky to me. But it works. And thats a Good Thing?. With the latest versions of WIndbg (6.x and newer) a new resets flag prevents this sort of hanging.

That is all there is to it. At this point, you can now go nuts with remote debugging. To make sure it works for ya just add some DbgPrint() messages to your ring 0 driver and watch them echo to the screen. Past that, I will leave it to your imagination how to use the debugger :)

Good luck!




©2008 Baidu



引文来源  在vmware上使用windbg进行双机内核调试_拉灯变黑客
  评论这张
 
阅读(1017)| 评论(0)

历史上的今天

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2018