Another question about DbgPrint hooking -
I’d like to keep last DbgPrint messages in a ring buffer, so
that in case of bugcheck, it will be included in the dumps.
Kind of the “in-flight recorder” of KMDF, and similar to what does
the DebugView.
The target runs in no-debug mode, and due to some reasons,
using DebugView is not possible.
Should I roll my own driver to hook DebugService (or whatever)
or there’s a simpler way?
– PA
****
-------- Original Message --------
Subject: Re: hooking DbgPrint
Date: Wed, 24 Dec 2008 10:48:55 -0500
From: Mark Roddy
So the strategy that works is to patch on older os’s that don’t
export DbgSetDebugPrintCallback and use DbgSetDebugPrintCallback on os;s
that do export it. This interface should be documented, by the way, as
uses such as James guest os debug log support are entirely legitimate.
Mark Roddy
On Wed, Dec 24, 2008 at 5:13 AM, Pavel A. mailto:xxxxx> wrote:
From a quick disassembly of the DbgView driver -
it seems that it calls DbgSetDebugPrintCallback on OSes
that export this, to install it’s handler.
Also it uses DbgSetDebugFilterState.
–PA
Skywing wrote:
There is a nice pluggable function pointer (nt!KiDebugRoutine)
which handles int 2d (DebugService). This toggles between
nt!KdpStub and nt!KdpTrap based on whether KD is enabled or not
(with KdpTrap being responsible for forwarding such activity on
to the debugger).
However, as Doron noted, this mechanism is guarded by PatchGuard.
There is a sanctioned (though the documentation seems to have
fallen by the wayside) interface for capturing user mode debug
output (DBWIN), though I don’t know of an officially blessed way
to do it for kernel mode callers that won’t incur wrath of
badness on 64-bit Windows. I suspect that DbgView probably just
hooks the IDT or KiDebugRoutine, but neither of those are going
to be permitted by PatchGuard by default. It might be
interesting, however, to see if it manages to work on 64-bit
systems. Perhaps there’s some feature in the debug print
buffering support that permits one to gain access to log
messages in a less invasive fashion.
- S
From: xxxxx@lists.osr.com
mailto:xxxxx
[mailto:xxxxx@lists.osr.com
mailto:xxxxx] *On Behalf Of
*Deepak Gupta
Sent: Wednesday, December 24, 2008 1:57 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] hooking DbgPrint
On Wed, Dec 24, 2008 at 11:53 AM, Maxim S. Shatskih
mailto:xxxxx>>
wrote:
>I would like to hook into DbgPrint at a lower level though so
that all
I think it is some IDT vector (int 2c?)
I think int 2c is “KeRaiseAssertion” (Observed it on Windows
Server 2008 64bit)
Better use inline hooking mechanism by locating the address of
DbgPrint.
Regards
Deepak
–</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>