Windows Kernel Debugging Introduction

In this video I will demonstrate how you can debug the Windows Kernel.
Dependencies:
- VirtualBox: winget install virtualbox
- windbg: winget install Microsoft.WinDbg
Links:
- Official Guide: learn.microsof...
- Unofficial Native API Docs: ntdoc.m417z.com/

[@nirlichtman]

- I used Win7 in this video since I just had the disk around, but you can also grab the Win10 iso from the official Microsoft website and the same method from this video will work (I think it also works with Win11 but I haven't tried yet) - Notice that after enabling debugging on the Windows boot settings, the machine will wait for a debugger connection each time it boots, you can bring it back to working normally by disabling debugging in bcdedit - I recommend making a snapshot before starting - so you can just easily restore it to the beginning state

[@marouaniAymen]

Thanks for the great video, but how to obtain a windows to run on a virtual machine ?

[@nirlichtman]

@@marouaniAymen I just installed from a physical installation disk of Windows 7 I have, you can also debug a physical computer

[@marouaniAymen]

@@nirlichtman Thanks for your answer

[@pouf-dk3nq]

windows has a really good debugger

[@nirlichtman]

Agreed, windbg is very powerful and I like the GUI as well

[@anonymouscommentator]

im curious as to why win 7 32bit was used. is it harder/not possible on modern versions?

[@n-uv7vg]

Same

[@jezura777]

I think he mentioned that only because the number that he passed to the function shows as pair of 2 bytes or as 32 bits in the debugger.

[@nirlichtman]

Reason I chose Win7 32bit is because that is the newest Windows installation disk I have in my room and also it has low system requirements, but this process should work the same in modern versions as well (modern versions even support additional types of kernel debugging - more info in the official docs)

[@dono42]

Arguments are passed differently between 32 and 64-bit processes. It is arguably easier to learn 32-bit first before moving on to 64-bit.

[@uschurch]

Wonderful. Hopefully many youtubers learn from you to make concise videos!

[@creakffm]

did u know how can i read out my kernel Ntst - baseadress

[@Tech69YT]

mine stuck at debugge not connected. i am trying to attach to win2016 server. i get connection established but it stuck at system up time and says debuggee not connected. i tried to break but did not work.

[@moshixmainframechannel]

Another great video !!

[@markarthur1083]

dds esp-0 esp+(4*2) shows the stack much clearer

[@satr14-tech]

13 hours ago... wow

[@haroldcruz8550]

Appreciate the video but it would have been better if it was for Windows 11

[@uschurch]

It's probably very similar.

[@FilthyPitDog]

great content ✌

[@ramorix]

Great video as always ! Keep going !

[@proto9011]

On Hyper-V the GUI interface doesn't have an option to configure COM ports. However, you can use the 'Set-VMComPort' PowerShell command from an elevated prompt to do so. Example) Set-VMComPort -Number 1 -Path \\.\pipe\MyDebugPort

[@sauvignonblanc5086]

Is it possible to debug playstation kernel?

[@nirlichtman]

Which playstation model?

[@sauvignonblanc5086]

@@nirlichtman PS4

[@0xSh1m1]

Great video! Where do you recommend learning how to use WinDbg?

[@nirlichtman]

.hh command, learn.microsoft.com has good materials, "Windows Debugging and Troubleshooting" lecture (you can find on YT), "Kernel_Debugging_Tutorial.doc" which is a great kernel debugging guide that comes with Windows SDK.

[@nonoroberto8219]

Thanks a lot for those videos about kernel debug!

[@nonoroberto8219]

I have a question though, where did you learn that stuff? Alone?

[@theSoberSobber]

Nice 👍

[@JayJay-ly4er]

thank you.

[@TunifyBasic]

can we still install windows 7 in 2024? i wan't an iso man.

[@nirlichtman]

I installed from a physical Win7 disk I have

[@1kvolt1978]

Yes, we can. And we will.