Re: Windows 10 Kernel Debugging on Xen

[Tamas K Lengyel <tamas.k.lengyel@gmail.com>]

Make sure windbg is already waiting for the connection from the
debugee by the time Windows starts booting. If you try to attach
windbg later it won't work. It worked for me but obviously YMMV.

Tamas

On Tue, Jun 22, 2021 at 2:07 PM Neil Sikka <neilsikka@gmail.com> wrote:
>
> I tried that, but it seems like I'm getting an interrupt storm on the debugger VM (CPU spends all its time in the kernel) when I try to attach the debugger. This observation furthers my suspicion that there is communication, but there is something wrong with the protocol...
>
> On Tue, Jun 22, 2021 at 12:43 PM Tamas K Lengyel <tamas.k.lengyel@gmail.com> wrote:
>>
>> I used Xen 4.15 and a pretty new version of Windows 10. It is a bit
>> finicky, you have to run the debug commands on the debugee and then
>> reboot. When the VM is rebooting the domain ID changes so you have to
>> start the serial bridge then. Windbg will attach afterwards. Just make
>> sure both VMs have serial='pty' set in their config file.
>>
>> Tamas
>>
>> On Tue, Jun 22, 2021 at 12:33 PM Neil Sikka <neilsikka@gmail.com> wrote:
>> >
>> > Thanks for the quick response, Tamas. I tried what you said and windbg waits and the debugee hangs when I click the break button in windbg, but I don't see any output in windbg. This means that there is SOME communication over the serial port that causes the debugee to hang when I click break. Could it be a debugger protocol issue? I also tried the guidance here by running the crlf program:
>> > https://www.qubes-os.org/doc/windows-debugging/
>> > But windbg waits and the debugee hangs in a similar manner.
>> >
>> > What versions of WIndows and Xen are you using?
>> >
>> > On Tue, Jun 22, 2021 at 12:10 PM Tamas K Lengyel <tamas.k.lengyel@gmail.com> wrote:
>> >>
>> >> I have managed to get windbg working with a serial bridge between two
>> >> Win10 VMs using the following script:
>> >> https://github.com/intel/kernel-fuzzer-for-xen-project/blob/master/scripts/serial-bridge.sh.
>> >> The debugee has to enable a couple options so that windbg can attach:
>> >> https://github.com/intel/kernel-fuzzer-for-xen-project/blob/master/scripts/debug.cmd.
>> >>
>> >> Tamas
>> >>
>> >> On Tue, Jun 22, 2021 at 12:01 PM Neil Sikka <neilsikka@gmail.com> wrote:
>> >> >
>> >> > Hello,
>> >> > Has anyone gotten a Windows10 (Version 1709 of later) kernel debugger attached when running the Windows10 debugger VM and the Windows10 debugee VM on Xen 4.13.0 hypervisor? I am getting a "NIC hardware initialization failed" error. I tried the suggestions in the discussion here (https://bugzilla.redhat.com/show_bug.cgi?id=1947015):
>> >> > -cpu Skylake-Server-IBRS,ss=on,vmx=on,hypervisor=on,tsc-adjust=on,clflushopt=on,umip=on,pku=on,md-clear=on,stibp=on,arch-capabilities=on,ssbd=on,xsaves=on,ibpb=on,amd-ssbd=on, \
>> >> > skip-l1dfl-vmentry=on,mpx=off,hv-time,hv-relaxed,hv-vapic,hv-spinlocks=0x1fff,hv-vendor-id=KVMKVMKVM
>> >> >
>> >> > note: i had to remove the following 2 arguments due to errors from QEMU:
>> >> > pschange-mc-no=on
>> >> > hv_vpindex
>> >> >
>> >> > Here was the error:
>> >> > C:\Users\user\Desktop\oldDebuggers\x64>kdnet.exe
>> >> >
>> >> > Network debugging is supported on the following NICs:
>> >> > busparams=0.4.0, Intel(R) PRO/1000 MT Network Connection, Plugged in.
>> >> > The Microsoft hypervisor running this VM does not support KDNET.
>> >> > Please upgrade to the hypervisor shipped in Windows 8 or WS2012 or later.
>> >> >
>> >> > KDNET initialization failed.  Status = 0xC0000182.
>> >> > NIC hardware initialization failed.
>> >> >
>> >> > I am using an Intel e1000 NIC emulated through QEMU because its supposedly a supported NIC for Windows kernel NET debugging.
>> >> >
>> >> > Thanks in Advance!
>> >> >
>> >> > --
>> >> > My Blog: http://www.neilscomputerblog.blogspot.com/
>> >> > Twitter: @neilsikka
>> >
>> >
>> >
>> > --
>> > My Blog: http://www.neilscomputerblog.blogspot.com/
>> > Twitter: @neilsikka
>
>
>
> --
> My Blog: http://www.neilscomputerblog.blogspot.com/
> Twitter: @neilsikka