Kernel Debugging Windows 7

Here are the settings that need to be done in Windows 7 for kernel debugging:

1. start cmd with admin rights
2. run bcdedit to see existing boot entries
3. create a copy of current boot entry. run bcdedit to get the ID of newly created entry.

bcdedit /copy {current}/d "debugboot"

4. set new boot entry as default. run bcdedit again to know the Identifier of this new debugboot entry.
bcdedit /default
5. set debug ON for this entry
bcdedit /debug ON
6. set debug settings: for e.g. for Serial port, COM1 and baudrate 115200
bcdedit /dbgsettings serial debugport:1 baudrate:115200
7. reboot the machine and you are done.

For debugging Windows over a Virtual machine; follow these steps;
1. In your windows guest VM, add a serial port as a named pipe with this end as server and other end as application.
2. create a shortcut of windbg and configure shortcut target as :
C:\WinDDK\7600.16385.1\Debuggers\windbg.exe -b -k com:pipe,port=\\.\pipe\com_1,resets=0





Here is some similar documentation on VMWare site:
http://www.vmware.com/support/ws3/doc/ws32_devices3.html#1023803

documentation on MSDN site:
http://technet.microsoft.com/en-us/library/cc721886%28WS.10%29.aspx

Read More...

Debug your applications without recompilation

Scenario:
You wanna debug an application but you dont have the code for it?
You suspect some functions that are failing, you dont feel like recompiling whole stuff in debug mode or put in print statements.

Solution:
Hook the APIs using LD_PRELOAD. (refer to my earlier post on hooking Linux)

Here is the code that I compiled into a .so which help me debug an issue in a binary. I wanted to get debug prints of a function that copies files to a directory. I needed to put print statements in the function, rather than that I used this method to get all copy commands being executed.

#include
#include
#include

#if defined(RTLD_NEXT)
#define REAL_LIBC RTLD_NEXT
#else
#define REAL_LIBC ((void *) -1L)
#endif

int system(char * command){
printf("Vij: system called - hacked\n");
static int (*o_dlconnect) ( char *command )=0;
o_dlconnect = (int(*)( char * )) dlsym(REAL_LIBC,"system"); printf("\n%s",command);
return (*o_dlconnect)( command );
}

Read More...