Re: Windows 10 Kernel Debugging on Xen

[Tamas K Lengyel <tamas.k.lengyel@gmail.com>]

I used Xen 4.15 and a pretty new version of Windows 10. It is a bit
finicky, you have to run the debug commands on the debugee and then
reboot. When the VM is rebooting the domain ID changes so you have to
start the serial bridge then. Windbg will attach afterwards. Just make
sure both VMs have serial='pty' set in their config file.

Tamas

On Tue, Jun 22, 2021 at 12:33 PM Neil Sikka <neilsikka@gmail.com> wrote:
>
> Thanks for the quick response, Tamas. I tried what you said and windbg waits and the debugee hangs when I click the break button in windbg, but I don't see any output in windbg. This means that there is SOME communication over the serial port that causes the debugee to hang when I click break. Could it be a debugger protocol issue? I also tried the guidance here by running the crlf program:
> https://www.qubes-os.org/doc/windows-debugging/
> But windbg waits and the debugee hangs in a similar manner.
>
> What versions of WIndows and Xen are you using?
>
> On Tue, Jun 22, 2021 at 12:10 PM Tamas K Lengyel <tamas.k.lengyel@gmail.com> wrote:
>>
>> I have managed to get windbg working with a serial bridge between two
>> Win10 VMs using the following script:
>> https://github.com/intel/kernel-fuzzer-for-xen-project/blob/master/scripts/serial-bridge.sh.
>> The debugee has to enable a couple options so that windbg can attach:
>> https://github.com/intel/kernel-fuzzer-for-xen-project/blob/master/scripts/debug.cmd.
>>
>> Tamas
>>
>> On Tue, Jun 22, 2021 at 12:01 PM Neil Sikka <neilsikka@gmail.com> wrote:
>> >
>> > Hello,
>> > Has anyone gotten a Windows10 (Version 1709 of later) kernel debugger attached when running the Windows10 debugger VM and the Windows10 debugee VM on Xen 4.13.0 hypervisor? I am getting a "NIC hardware initialization failed" error. I tried the suggestions in the discussion here (https://bugzilla.redhat.com/show_bug.cgi?id=1947015):
>> > -cpu Skylake-Server-IBRS,ss=on,vmx=on,hypervisor=on,tsc-adjust=on,clflushopt=on,umip=on,pku=on,md-clear=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,ibpb=on,amd-ssbd=on, \
>> > skip-l1dfl-vmentry=on,mpx=off,hv-time,hv-relaxed,hv-vapic,hv-spinlocks=0x1fff,hv-vendor-id=KVMKVMKVM
>> >
>> > note: i had to remove the following 2 arguments due to errors from QEMU:
>> > pschange-mc-no=on
>> > hv_vpindex
>> >
>> > Here was the error:
>> > C:\Users\user\Desktop\oldDebuggers\x64>kdnet.exe
>> >
>> > Network debugging is supported on the following NICs:
>> > busparams=0.4.0, Intel(R) PRO/1000 MT Network Connection, Plugged in.
>> > The Microsoft hypervisor running this VM does not support KDNET.
>> > Please upgrade to the hypervisor shipped in Windows 8 or WS2012 or later.
>> >
>> > KDNET initialization failed.  Status = 0xC0000182.
>> > NIC hardware initialization failed.
>> >
>> > I am using an Intel e1000 NIC emulated through QEMU because its supposedly a supported NIC for Windows kernel NET debugging.
>> >
>> > Thanks in Advance!
>> >
>> > --
>> > My Blog: http://www.neilscomputerblog.blogspot.com/
>> > Twitter: @neilsikka
>
>
>
> --
> My Blog: http://www.neilscomputerblog.blogspot.com/
> Twitter: @neilsikka