Skip to content

README.md

Latest commit

 

History

History
179 lines (141 loc) · 5.05 KB

README.md

File metadata and controls

179 lines (141 loc) · 5.05 KB
Raw

Some useful windbg batch scripts

Last updated: 28.01.2023

Contents

enableDbgPrint

Statically enable debug print for KD WinDbg by setting a registry key. Takes effect only after a reboot.

Usage

$ enableDbgPrint.bat [/i <componentId>] [/l <level>] [/c] [/d] [/v]

Options:

  • /i: Component id of debugged module. Default: DEFAULT. Can be set to other values to avoid spamming of components.
  • /l: Severity of the message being sent. Can be any 32-bit integer.
    Numbers between 0 and 0x1F are interpreted as a bit shift (1 << Level). I.e. /l 0x1f sets the 31th bit, the bit field becomes 0x80000000.
    Numbers between 0x20 and 0xFFFFFFFF set the importance bit field value itself. I.e. /l 0x80000000 <=> /l 0x1f.
  • /c: Check current debug filters.
  • /d: Delete setting of specified component.

Other:

  • /v Verbose mode

Remarks

ComponentId

Specifies the component calling this routine (i.e. DbgPrint(Ex)). This must be one of the component name filter IDs defined in the Dpfilter.h header file. To avoid mixing your driver's output with the output of Windows components, you should use only the following values for ComponentId: DPFLTR_IHVVIDEO_ID, DPFLTR_IHVAUDIO_ID, DPFLTR_IHVNETWORK_ID, DPFLTR_IHVSTREAMING_ID, DPFLTR_IHVBUS_ID, DPFLTR_IHVDRIVER_ID. The name used as the registry values seems to skip the prefix and suffix. So the values would be: IHVVIDEO, IHVAUDIO, IHVNETWORK, IHVSTREAMING, IHVBUS, IHVDRIVER.

Predefined levels are

#define   DPFLTR_ERROR_LEVEL     0
#define   DPFLTR_WARNING_LEVEL   1
#define   DPFLTR_TRACE_LEVEL     2
#define   DPFLTR_INFO_LEVEL      3

All messages sent by DbgPrint and KdPrint are associated with the DEFAULT component.

Info

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-dbgprintex
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/reading-and-filtering-debugging-messages

setNetKd

Set guest system up for net kd. BcdEdit wrapper.

Usage

$ setNetKd.bat [/i <ip>] [/p <port>] [/k <key>] [/b <param>] [/dhcp] [/d] [/bd] [/c] [/r] [/v] [/h]

Options:

  • /i The host ip.
  • /p The connection port. Default: 50000.
  • /k The connection key. If not set, a random key will be generated.
  • /b The bus param of the network device. Usually works without setting it. If not: Use kdnet.exe or open the property page for the network adapter :: details > Location information.
  • /dhcp For DHCP.
  • /r Reboot system with prompt.
  • /d Set debug on.
  • /bd Set bootdebug on.
  • /c Clear all debug settings.
  • /r: Reboot system with confirmation prompt.
  • /v Verbose mode
  • /h Print this

Remarks

If if does not work after the reboot, i.e. debugger is not attached, most likely the IP of the Network Adapter has changed. Now it's called "Ethernet (Kernel Debugger)". The IP has to be corrected to the former value or some other correct ip in the network/subnet. After a reboot it should connect.

setUsbKd

Set guest system up for usb kd. BcdEdit wrapper.

Usage

$ setUsbKd.bat [/n <name>] [/b <param>] [/d] [/bd] [/c] [/r] [/v] [/h]

Options:

  • n The target name.
  • /b The bus param of the network device. Use usbview.exe to get it. Commonly its "0.20.0".
  • /r Reboot system with prompt.
  • /d Set debug on.
  • /bd Set bootdebug on.
  • /c Clear all debug settings.
  • /r: Reboot system with confirmation prompt.
  • /v Verbose mode
  • /h Print this

startComKDbg

Starts kernel WinDbg with a com pipe.

Usage

$ startComKDbg.bat [/a x86|x64] [/n pipename]

Options:

  • /a Architecutre of WinDbg (x86|x64).
  • /n The kd com port pipe name. Will be extended to \\.\pipe\pipename

startEDbg

Starts usermode WinDbg session with a program cmd line.

Usage

$ startEDbg.bat [/a <arch>] /c cmdline [/o] [/s <path>] [/y <path>] [/h]

Options:

  • /a Architecutre of WinDbg (x86|x64).
  • /c The command line. I.e. "c:\windows\System32\ping.exe 127.0.0.1"
  • /o Debug child process flag.
  • /s src path.
  • /y symbol path.

startNetKDbg

Starts kernel WinDbg session over network.

Usage

$ startNetKDbg.bat [/a <arch>] [/p <port>] [/k <key>] [/bml] [/loc] [/v] [/h]

Options:

  • /a The arch: x86|x64. Default: x64.
  • /p The Port. Min: 49152, Max: 65535.
  • /k The network key. Default: 1.2.3.4.
  • /bml Break on module load.
  • /loc Starts a local kernel debugging session (on the same machine as the debugger).
  • /v Verbose mode.

startUsbKDbg

Starts kernel WinDbg session over usb connection.

Usage

$ startUsbKDbg.bat [/a <arch>] [/n <name>] [/bml] [/loc] [/v] [/h]

Options:

  • /a The arch: x86|x64. Default: x64.
  • /n The usb debugging target name.
  • /bml Break on module load.
  • /loc Starts a local kernel debugging session (on the same machine as the debugger).
  • /v Verbose mode.