Windows Kernel Debugging Learning Notes 001 Environment Building

Some learning notes about Windows kernel, this one is mainly about environment building

Source: Moeomu’s blog

Download Tools


Install Windows Virtual Machine

Initially use Windows 7 SP1 x86 as an example to learn

  • MSDN download the official image
  • VMWare Workstation 16 to build a virtual environment

Configure the Windows kernel debug virtual machine

Remove the printer device from this virtual machine

Add serial serial port

  • Click Use named pipe
  • Fill in the string: \\.\pipe\Windows7x86 (you can fill in the pipeline naming you wish, but you can only modify the Windows7x86 location)
  • Below select that end is the server and the other end is the application
  • In I/O mode, select Active abort when polling

The configuration is completed as shown below

Virtual Machine Configuration Diagram

Configure Windows 7

  • Enter the command msconfig and click boot as shown below

boot

  • Click on advanced options, enable debugging, baud rate, as shown

advanced-options


Configure WinDbg Preview

  • First start the proxy network for unlocking GFW restrictions
  • Set up WinDbg’s symbol server and local cache directory SRV*D:\LocalSymbols*http://msdl.microsoft.com/download/symbols
  • Attach to kernel-COM-check all the checkboxes you can-fill the baud rate-fill the port with \\.\pipe\Windows7x86
  • Click OK to debug the virtual machine kernel
  • Set WinDbg’s symbol server proxy set _NT_SYMBOL_PROXY=proxy server address:port number
Licensed under CC BY-NC-SA 4.0
Built with Hugo
Theme Stack designed by Jimmy