Setting Up Kernel Debugging
Debugging in the kernel is more complicated than debugging a user-space program because when the kernel is being debugged, the OS is frozen, and it’s impossible to run a debugger. Therefore, the most common way to debug the kernel is with VMware.
Unlike user-mode debugging, kernel debugging requires a certain amount of initial setup. You will need to set up the virtual machine to enable kernel debugging, configure VMware to enable a virtual serial port between the virtual machine and the host, and configure WinDbg on the host machine.
You will need to set up the virtual machine by editing the normally hidden C:\boot.ini file. (Be sure that your folder options are set to show hidden files.) Before you start editing the ...
Get Practical Malware Analysis now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
