5 ms·
Can you no longer use windbg to attach to a running kernel on a remote box, and debug the remote box from your development machine? I believe that's how kernel
by ccrush 4y ago
Can you no longer use windbg to attach to a running kernel on a remote box, and debug the remote box from your development machine? I believe that's how kernel debugging is generally done.
- ace2358 4y agoThat’s probably true, but sometimes you have to go one level deeper right? What happens when your debugger has crashed?
- Arainach 4y agoIn 8 years on the Windows team I can't recall the debugger ever crashing. If it does, you open the debugger again and reconnect to the target machine.
- hyperrail 4y agoHeh, I wish that had ever been the case for me. Sometimes it feels like WinDbg freezes every other command. Plus, getting it to reconnect to a kd after it freezes and I kill it was such an exercise in frustration that if the target machine were my own repro box instead of a stress break remote, I would have just hard-reset the machine or (if it were a VM) restored it from snapshot.
- amluto 4y ago(I’m a Linux kernel dev) Tools like windbg probably work great until you are debugging the code that runs when windbg tries to take over. Or you’re debugging something sensitive to interrupts and it’s literally impossible to keep up with a tool like windbg. Or you a debugging something that overwrites windbg in memory because you have a corrupt pointer. Or you triple-fault the machine and it reboots with so much prejudice that windbg doesn’t have a chance. Or you’re poking at hardware that the debugger can’t usefully interact with. Etc. Basically, in the kernel, a lot of the things that a working kernel does to hold your hand aren’t available. So there’s a lot of time spent just thinking or adding logging statements or otherwise using low tech tools. (Or using high tech instrumentation or sanitizers!) Kernel development is great :)
- starfleet_bop 4y agoDoes x86 have a JTAG like / hardware debugger?
- vbitz 4y agoYou can get something like JTAG from Intel with a NDA. https://designintools.intel.com/Silicon_View_Technology_Closed_Chassis_Adapter_p/itpxdpsvt.htm https://designintools.intel.com/Silicon_View_Technology_Clos... Most of the time you can do kernel dev with a serial port and printf though.
- pjmlp 4y agoWindows kernel can generate ETW profiling data, no need to manually add logging information after the fact. https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/event-tracing-for-windows--etw- https://docs.microsoft.com/en-us/windows-hardware/drivers/de...
- muricula 4y agoI have debugged the kernels of Windows, Linux and now iOS using internal tools. Windbg generally works, and is far superior to the equivalent tools for other kernels. Like vim it has a baroque syntax and a steep learning curve, but it also has a gui with big buttons to compensate. Yeah, you can get yourself in bad situations, especially in early boot, but I miss it.
- amluto 4y agoI confess that it’s been years since I used WinDbg. It was quite bare bones back then. These days I mostly use gdb (which is incredibly buggy for such things) attached to QEMU’s gdbserver. It works except when I doesn’t.
- DaiPlusPlus 4y agoI thought everyone doing OS/kernel dev would be running code in a VM they can pause, snapshot, and single-step all without a guest debugger?