replacing driver with .kdfiles

NTDEV
1

I read this article on osr about .kdfiles and tried to get it running but with no success.
All seems good but if I reload the driver the it isn’t replaced. Windbg says nothing. If I use .kdfiles without parameter the map file is correctly read.

Does someone use this cmd?

I tried it with the toaster example and this is the output from .kdfiles:

KD file associations loaded from ‘D:\project\toaster_kdfiles.ini’
\systemroot\system32\drivers\wdf\wdftoastmon.sys -> E:\wd-example\wdk_10\general\toaster\toastDrv\kmdf\toastmon\x64\Debug\wdftoastmon.sys

2

I use .kdfiles always. It’s VERY picky about the names, like capitalization matters. One way to figure out the exact correct name is to turn on the module load info, and windbg will spit our the exact name string it’s trying to match on.

Jan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@x-publisher.com
Sent: Sunday, January 14, 2018 10:22 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] replacing driver with .kdfiles

I read this article on osr about .kdfiles and tried to get it running but with no success.
All seems good but if I reload the driver the it isn’t replaced. Windbg says nothing. If I use .kdfiles without parameter the map file is correctly read.

Does someone use this cmd?

I tried it with the toaster example and this is the output from .kdfiles:

KD file associations loaded from ‘D:\project\toaster_kdfiles.ini’
\systemroot\system32\drivers\wdf\wdftoastmon.sys -> E:\wd-example\wdk_10\general\toaster\toastDrv\kmdf\toastmon\x64\Debug\wdftoastmon.sys

3

I solved it.
Be careful if you check the destination directory with the nt!KdPullRemoteFile breakpoint. The output of the “dS @rcx” leads me in the wrong direction.
The output was:
\systemroot\system32\drivers\wdf
but this was not true because the driver was in:
\systemroot\system32\drivers\
After changing this the driver is updated.