windbg + vmware 内核调试环境设置

古城微笑少年丶 2022-01-23 05:13 318阅读 0赞

windbg 符号设置：

配置环境变量：

\_NT\_SYMBOL\_PATH

SRV\*c:\\mysymbol\* http://msdl.microsoft.com/download/symbols

![20190602162321396.PNG][]

vmware 添加串口：

编辑虚拟机设置-->硬件-->打印机移除（存在）-->添加-->串行端口-->输出到命名管道-->轮询时主动放弃CPU

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 1][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 2][] ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 4][]

windows 调试启动项设置：

XP:

开始-->我的电脑-->工具-->文件夹选项-->查看

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 5][]

修改C:\\\\boot.ini 添加：

multi(0)disk(0)rdisk(0)partition(1)\\WINDOWS="Microsoft Windows XP Professional Debug" /fastdetect /debugport=com1 /baudrate=115200![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 6][]

win7:

管理员权限启动：cmd

bcdedit /copy \{current\} /d "Windwos7"

bcdedit /debug ON

bcdedit /bootdebug ON

bcdedit /dbgsettings

bcdedit /timeout 10

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 7][]

win10:

管理员权限启动：cmd

bcdedit /dbgsettings serial baudrate:115200 debugport:1

bcdedit /copy \{current\} /d WinDebug

bcdedit /displayorder \{current\} \{ID\}

bcdedit /debug \{ID\} ON

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 8][]

为配置号的虚拟机创建快照，方便以后还原到最初状态。

windbg 快捷方式设置：

xp: -b -k com:pipe,port=\\\\.\\pipe\\com\_1,resets=0

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 9][]

vista: -b -k com:port=\\\\.\\pipe\\com\_1,baud=115200,pipe

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 10][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 11][]

测试：

vmware-->windbg-->g-->ctrl + break -->lm

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 12][]

[20190602162321396.PNG]: /images/20220123/1119fc157ed04fe38b542ecd95e50a19.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70]: /images/20220123/65e04f402e7a4eb68432529fe8a342e1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 1]: /images/20220123/fd380c68d4244add8d3a59380680af57.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20190602164114636.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 3]: /images/20220123/44d3171a119440bf97c3dc034670d735.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 4]: /images/20220123/702baa04ff424461b3c4d58b9a4f4123.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 5]: /images/20220123/9bd96c883e864e36af77674c00336695.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 6]: /images/20220123/fbdd9eb3f8fd481baa00eefb1d2681ff.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 7]: /images/20220123/19d2badcd8c442abab56f3c02bd11d77.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 8]: /images/20220123/762ebc974ac748f2a5bb69eddf7b2562.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 9]: /images/20220123/32f50b033b8c4308a4ab6d7e1e990d92.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 10]: /images/20220123/99201e8a539e411a8de099b70cb1144a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 11]: /images/20220123/5e77bbaf582f4dd5ad11d6c8951edc63.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h1YW5vbmd5aW5nMTMx_size_16_color_FFFFFF_t_70 12]: /images/20220123/14328692a1c745699e019cb69b1f12e8.png