Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to break when a DLL is loaded in kernel debugger mode?

Tags:

windbg

In user mode debugging, I usually break with the following command:

sxe ld Something.dll

I tried the same in kernel mode, but it is not working. Is there a different command?

like image 536
kiewic Avatar asked Jul 09 '14 23:07

kiewic


People also ask

How do I disable kernel debugging?

To disable kernel debugging on the target computer, open a Command Prompt window as Administrator and enter the command bcdedit /debug off. Reboot the target computer.

What is break into debugger?

If a user-mode debugger is attached, the program will break into the debugger. This means that the program will pause and the debugger will become active.


2 Answers

You will want to run:

!gflag +ksl
sxe ld Something.dll
g

You may also want to refer to [1], which discussing breaking into a process near boot-time using the above approach.

[1] How do I debug a process that starts at boot time?

like image 163
Eagle Avatar answered Nov 15 '22 10:11

Eagle


While doing kernel mode debugging : using sxe you will be able to break ONLY for kernel mode binaries like *.sys file.

Not for user mode binaries like *.dll

If you share what you are trying achieve may be we can find some other way to achieve that !

like image 28
Player Avatar answered Nov 15 '22 11:11

Player