Introduction to Windows Kernel Mode Debugging
summary
Practical, hands‑on primer that shows how to reproduce bugs, collect artifacts and find root causes: uses WinDbg connected via a VMware pipe to capture kernel memory dumps and live snapshots, recreates a looping thread that masks as low CPU, a two‑thread deadlock and a BSOD with bugcheck IRQL_NOT_LESS_OR_EQUAL. Uses commands like !analyze -v and !locks to get call stacks and lock owners, demonstrates offending code (infinite loop, nested locks, paged‑pool access at DISPATCH_LEVEL) and confirms fixes (add yields or break conditions, enforce lock ordering, use try/except and non‑paged memory).
AI-written summary · about
chapters (27)
- 0:00Introduction
- 2:25Agenda
- 5:00Symbols
- 6:05Symbol Server
- 6:41First Bluescreen
- 7:18Windbg
- 7:47Source code
- 8:37How to collect BSOD dumps
- 9:10How to configure Life Kernel Debugging with VMware
- 10:38General approach to software problems
- 11:51CPU problem
- 16:50Snapshot
- 17:23Example
- 17:41Looping
- 18:00Code Location
- 18:43Fixing is not Universal
- 19:21deadlock
- 20:05costax
- 20:31sample code
- 21:14get lock information
- 22:05match source code location
- 22:21fix for developer
- 24:10blue screen
- 24:55bug check
- 25:45kernel
- 27:48hack
- 28:03conclusion
related talks
46mFor The Win: The Art Of The Windows Kernel Fuzzing
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
58mDebugging one layer deeper
28mDigtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities
40mWindows Kernel Patch Protection - Achilles Heel: PatchGuard
43mDebug for Bug: Crack and Hack Apple Core by Itself
56mWindows Kernel Graphics Driver Attack Surface
01h 00mExceptional C++