Viewing user mode debug messages with kernel debugger\WinDbg on VistaX64

WINDBG
1

Is it possible to view the output of user debug messages from a user app in a kernel debugger session of WinDbg in Vista x64?

I’ve already modified the default mask as necessary for kernel debug messages, but this does not appear to have any effect on user mode messages.

I tried:

  • modifying the registry entry HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter and rebooting
  • setting KD_default_mask, kd_usergdi_mask and kd_win2000_mask to 1,8,f and ffffffff
  • invoking ntdll!DbgPrint and ntdll!DbgPrintEx(with appropriate masks)

But these do not work. How can I get my user mode message to a kernel debugger on that OS?

2

It certainly used to be possible. Comdlg32 made a career out of it.

Not really sure what the mask is.

mm

On Aug 6, 2010 6:31 PM, wrote:

Is it possible to view the output of user debug messages from a user app in
a kernel debugger session of WinDbg in Vista x64?

I’ve already modified the default mask as necessary for kernel debug
messages, but this does not appear to have any effect on user mode messages.

I tried:
- modifying the registry entry HKLM\SYSTEM\CCS\Control\Session
Manager\Debug Print Filter and rebooting
- setting KD_default_mask, kd_usergdi_mask and kd_win2000_mask to 1,8,f and
ffffffff
- invoking ntdll!DbgPrint and ntdll!DbgPrintEx(with appropriate masks)

But these do not work. How can I get my user mode message to a kernel
debugger on that OS?

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Hm… I just grabbed comdlg32.dll off of my Vista VM and it doesn’t seem to import anything that jumps out at me.

Thanks anyway.

4

xxxxx@yahoo.com wrote:

Hm… I just grabbed comdlg32.dll off of my Vista VM and it doesn’t seem to import anything that jumps out at me.

I think he was making a snarky comment that comdlg32.dll had a nasty
habit of SPEWING those messages.

I’ve never had to do anything to get user-mode OutputDebugString
messages to appear in windbg. Now, if you are running your app inside
the Visual Studio debugger, I believe it intercepts the ODS messages
before they go to the kernel.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

You didn’t ask for this explicitly, but you might be interested in using
ntsd or cdb with the “-d” switch. This starts a user-mode debugger on your
process and then passes control to the kernel debugger. Not only will you
see any messages that result from debugging the process, but if the user
mode debugger breaks, you’ll get control in the kernel debugger’s command
window.

This strategy is useful if you have a lot of processes to debug and you want
a central place to interact with them. It’s also useful if your test
machine is under so much stress that it’s difficult to interact with the
user interface, as the kernel debugger’s UI is on another machine.

–
Jake Oshins
Hyper-V I/O Architect
Windows Kernel Group

This post implies no warranties and confers no rights.

“Tim Roberts” wrote in message news:xxxxx@windbg…
> xxxxx@yahoo.com wrote:
>> Hm… I just grabbed comdlg32.dll off of my Vista VM and it doesn’t seem
>> to import anything that jumps out at me.
>
> I think he was making a snarky comment that comdlg32.dll had a nasty
> habit of SPEWING those messages.
>
> I’ve never had to do anything to get user-mode OutputDebugString
> messages to appear in windbg. Now, if you are running your app inside
> the Visual Studio debugger, I believe it intercepts the ODS messages
> before they go to the kernel.
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>

6

If you use transport VirtualKD (kdvm.dll or kdvmware.dll) then at system boot run WinDbg command:
* X32: “eb 0xffdf02d4 3”
* X64: “eb 0xFFFFF780000002d4 3”