windbg + winRT (WOA windows on ARM) kernel debug

有看到WoA的机器，就想尝试在WoA上调试AP、Driver。

目前，由于windbg没有ARM的版本，因此无法想x86、x64平台那样简单、快捷的来调试。因此只好通过remote debug的这种方式来尝试。

首先想到的是利用windbg，进行本机kernel debug，在WoA的WDK中真的有windbg ARM版本，很兴奋的装上去，打开kernel debug时，发现local根本无法支持，一直显示需要运行 "bcdedit /debug on" 然后 "reboot"，尝试了很多遍，一直重复这样的提示。无法进入kernel debug。

其次想到的是利用 usb debug cable，双机互联，透过windbg来调试，没想到WoA不支持此方法。原因么，下面会提到。双机连接，打开debug模式后，无法互联。

最后想到的是利用 VS2012 的remote debug，但是在vs2012的目录下并没有找到支持ARM的remote debugger，只有x86、x64。

好了，上面的方法统统行不通，只好网络上搜集，据win8发布会视频介绍，可以直接利用usb direct cable进行互联，需要找到WoA上的一个特殊端口，在debug模式下，这个端口会被视作一个usb debug target，双机互联后，目标机器会被视作一个 usb debug target，在源机器上可以透过devcie manager看到一个 mocrosoft usb debug target。这里的源机器是win7系统，系统可以自动识别这个device，其他系统可以尝试手动加载驱动usb2dbg.sys。打开windbg，选择kernel debug -> USB 可以顺利连上目标机器。

ok，在源机器上打开windbg，可以显示connect成功，但是。。。但是没有log。什么原因呢，看起来ARM并不是那么容易show log。在OSR上找到一篇文章介绍了如何在目标机器上打开log。参考： http://www.osronline.com/article.cfm?article=295

Getting DbgPrint Output To Appear In Vista and Later 

OSR Staff | Published: 11-May-04| Modified: 25-Jan-13 

The problem: Your DbgPrint or KdPrint messages don't appear in WinDbg (or KD) when you run your driver on Windows Vista, Windows 7, or Windows 8.

The reason?  Versions of Windows starting with Vista automatically map DbgPrint and friends to DbgPrintEx.  Now, you may recall that DbgPrintEx allows you to control the conditions under which messages will be sent to the kernel debugger by filtering messages via a component name and level in the function call and an associated filter mask in either the registry or in memory. 

DbgPrint and KdPrint are mapped to component "DPFLTR_DEFAULT_ID" and level "DPFLTR_INFO_LEVEL".  Of course xxx_INFO_LEVEL output is disabled by default.  So, by default, your DbgPrint/KdPrint doesn't get sent to the kernel debugger.

 

How to fix it? Two choices:

• Enable output of DbgPrint/KdPrint messages by default -- Open (or add, if it's not already there) the key "HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter".  Under this key, create a  value with the name "DEFAULT"  Set the value of this key equal to the DWORD value 8 to enable xxx_INFO_LEVEL output as well as xxx_ERROR_LEVEL output.  Or try setting the mask to 0xF so you get all output.  You must reboot for these changes to take effect.  Note... Don't set the value named "(default)" -- You actually have to create a new value with the name "DEFAULT" and set that to whatever value you want (0xF, for example).
  
  
• Specifically change the component filter mast for DPFLTR. Starting with Windows Vista you need to set the mask value for the DWORD at Kd_DEFAULT_MASK ("ed Kd_DEFAULT_MASK").  You can specify 8 to enable DPFLTR_INFO_LEVEL output in addition to DPFLTR_ERROR_LEVEL output, or 0xF to get all levels of output.

See the WDK documentation for Reading and Filtering Debugging Messages (follow the path: Driver Development Tools\Tools for Debugging Drivers\Using Debugging Code in a Driver\Debugging Code Overview) for the complete details on the use of DbgPrintEx/KdPrintEx.  Or look at the Debugging Tools For Windowsdocumentation (Appendix A) on DbgPrintEx.

Tweet

笔者有尝试上述方法，还是没有能够产生LOG，最终在windbg中运行以下命令真的看到LOG了：

ed Kd_DPFLTR_MASK 0xFF

至此，windbg + WoA 顺利进入kernel debug 模式。