Kernel Debugging
Advanced
Kernel debugging is essential for analyzing rootkits, drivers, and kernel-mode exploits. WinDbg is the primary tool for Windows kernel debugging: Microsoft's current client, formerly shipped as WinDbg Preview, is the recommended download, and WinDbg (classic) is the older user interface still available with Debugging Tools for Windows.
WinDbg Setup
windbg-kernel.txt
# Enable kernel debugging on target VM
bcdedit /debug on
bcdedit /dbgsettings serial debugport:1 baudrate:115200
# Or use network debugging (Windows 8+)
# key: is mandatory - bcdedit rejects the setting without it.
# Use four non-zero decimal octets; the same key is entered in WinDbg on the host.
bcdedit /dbgsettings net hostip:192.168.1.100 port:50000 key:1.2.3.4
# Connect WinDbg (host)
# WinDbg (classic): File → Kernel Debug → COM / NET
# The current WinDbg client (formerly WinDbg Preview) is the recommended
# download and reaches the same COM and NET targets from its own attach flow.
# WinDbg commands
!process 0 0 ; List all processes
!thread ; Current thread info
!pte <address> ; Page table entry
!pool <address> ; Pool allocation info
# Driver analysis
lm ; List loaded modules
lm m nt ; ntoskrnl info
!drvobj \Driver\MyDriver ; Driver object
# Set breakpoints
bp nt!NtCreateFile ; Break on syscall
bp mydriver!DriverEntry ; Break on driver load
# Memory commands
db <addr> ; Display bytes
dd <addr> ; Display dwords
dq <addr> ; Display qwords
u <addr> ; Unassemble
# Symbols
.sympath srv*c:\symbols*https://msdl.microsoft.com/download/symbols
.reload /fKernel Crash
Kernel debugging can cause system instability. Always use virtual machines and save snapshots
before debugging sessions.