-
-
Notifications
You must be signed in to change notification settings - Fork 3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
WinDbg/KD protocol support #17130
Comments
ref #1692 |
Aside from the lack of support in anything except for 8, 8.1 and 10, is there any reason to use a virtual serial device instead of Ethernet? |
A serial port requires much less code to work, so its usually less intrussive to debug kernels over serial port than ethernet. Networking requires a lot of logic and drivers to work. Serial port debugging is not supported on win>=8? |
At the end, the protocol is the same, so, it should be possible to use r2 with socat |
@Manouchehri @radare Ethernet is in TODO, but it much more complex. And it has some differences between windbg over serial and over ethernet. |
@radare Sorry, serial debugging is included in Windows >= 8 as well. I meant that in addition to serial debugging, there's also network debugging (and is not included in < 8). My bad for wording that poorly. I've heard some complaints about performance when using a 115.2 Kbps serial link; at the same time, I rarely see anyone using the kernel-mode debugger with Ethernet, so I wanted to double check to make sure I wasn't overlooking something.
@JumpCallPop already has a lot of the work done with libKDNET. I couldn't find any other work done on KDNET aside from this. If anyone else has more information, feel free to pipe in. =) @XVilka Thanks. Any suggestions on where I should start? If not, I'll just poke around. |
@Manouchehri see the https://github.com/radare/radare2/tree/master/shlr/wind - this is the implementation of the WinDbg protocol and this is a radare2 part of WinDbg support https://github.com/radare/radare2/blob/master/libr/debug/p/debug_wind.c Here is the documentation how to work with it using radare2 https://github.com/radare/radare2/blob/master/doc/windbg I think you need to see shlr/wind/transport.[ch] and shlr/wind/iob_pipe.c Please, notice that all WinDbg code should be under LGPLv3. |
@Manouchehri and a bit more links: See also VirtualKD program http://virtualkd.sysprogs.org/ And KD protocol description http://articles.sysprogs.org/kdvmware/kdcom/ WinDbg protocol sniffer - https://code.google.com/p/windbgshark/ http://www.msuiche.net/2014/01/12/extengcpp-part-1/ |
And of course, see the famous PyKD sources too https://pykd.codeplex.com/ |
Perfect, thanks! Glad I asked, those links should keep me busy for awhile. |
@Manouchehri and one more thing:
Preventing this somehow would be awesome. |
@Manouchehri sorry for spamming you, but forgot also to mention that using RSocket (r_socket) will help you to forget about platform support, see https://github.com/radare/radare2/tree/master/libr/socket For usage example see HTTP server sources https://github.com/radare/radare2/blob/master/libr/socket/http_server.c |
No problem, it's my fault for not joining the IRC channel. I'll get around to that sometime. |
I wrote a Wireshark dissector for part of the Windbg/KD network protocol: It is incomplete, but decryption works and most higher-level structures are dissected. Here is also a capture and the related Windbg output with a Windows 10 machine as debugger and Checked/Debug build of Windows 10 as debuggee: Hope it helps in some way. |
Cc @skuater @jroimartin @XVilka
|
@Lekensteyn thanks a lot! I'll check this |
Hello ! This will be usefull for you : https://github.com/Winbagility/Winbagility/tree/master/src/Winbagility 2016-06-02 12:49 GMT+02:00 Anton Kochkov notifications@github.com:
|
@xarkes can you please write small summary here, what is still missing. what doesn't work as expected, what can/should be done, what are biggest challenges on improving WinDbg support, like a note for a future developer, who will want to continue it? |
This would allow anyone to work more fluently with it. Then comes:
That's all I have in mind for now |
@josediazfer since you are on Windows debugging you may also want to check this one, if you are interested. |
@GustavoLCR @pelijah FYI |
The text was updated successfully, but these errors were encountered: