Topic created on: April 7, 2011 15:12 CDT by sulacco.
Hi! I'm trying to trace function in kernel driver, but problem it is reentrant, while I trace it in this function, then suddenly computer execution goes to other place.
How trace whole kernel function without interruption?
you can setup the remote debugging with your pc - vmware using windbg. For example you want to trace/debug 123.sys driver.
1. Load the 123.sys driver into IDA Pro, get the offset address of EntryPoint
2. RVA = EntryPoint - AddressOfEntryPoint
3. Boot up vmware with remote debugging with windbg
4. copy the 123.sys into vmware
5. in Windbg (PC), key in the following command
kd> bp 123+RVA
6. in vmware, load the 123.sys with driver loader and execute
7. windbg will landed at the entrypoint of 123.sys
Note: Registration is required to post to the forums.