microsoft / WinDbg-Samples

Sample extensions, scripts, and API uses for WinDbg.
MIT License
719 stars 120 forks source link

Windbg and Usermode Code, Build-in commands #49

Closed RanjaniN-10 closed 2 years ago

RanjaniN-10 commented 2 years ago

Hello,

I am working with Windebugger and a User Mode Driver sample code(attached for reference). Created an executable file of the Sample Driver Code by altering the Settings in Visual Studio and connected with Windebugger. Symbol file path is set to the folder where the Pdb file is located. After reload, new executable command tab opens.

`#include "driver.h"

VOID Unload(IN PDRIVER_OBJECT DriverObject){ DbgPrint("Driver unload \r\n"); } NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath){ DbgPrint("Hello world\r\n"); return STATUS_SUCCESS; }`

Ran few build-in commands in Windbg such as lm,kp,dv During execution of dv, received the following error

dv
Unable to enumerate locals, Win32 error 0n318
Private symbols (symbols.pri) are required for locals.
Type ".hh dbgerr005" for details.
windbg> .hh dbgerr005

Capture2

Questions: 1) Which private symbol to be added and how to add them? 2) Can I able to print the driver code output in Windbg? 3) Kindly share with some usermode driver code samples for Windbg to get familiarise

Thanks in advance Ranjani N