调试虚拟机:
xp:
修改目标机 boot.ini, 增加一个调试启动项;
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Protessional" /noexecute=option /fastdetect /edbug /debugport=com1 /baudrate=115200
Vista :
cmd:
bcdedit /copy {current} /d "Windows Vista Copy"
bcdedit /edbug ON
bcdedit /bootdebug ON
bcdedit /dbgsetting
bcdedit /timeout 7
虚拟机:
增加串口硬件, 设置 output to named pipe
名字: \\.\\pipe\com_1
windbg设置:
建议快捷方式:
windbg.exe -b -k com:port=\\.\pipe\com_1,baud=115200,pipe
访问GDT的设备: Device\PhysicalMemory
IrpMon
sfilter 文件系统驱动
xp:
修改目标机 boot.ini, 增加一个调试启动项;
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Protessional" /noexecute=option /fastdetect /edbug /debugport=com1 /baudrate=115200
Vista :
cmd:
bcdedit /copy {current} /d "Windows Vista Copy"
bcdedit /edbug ON
bcdedit /bootdebug ON
bcdedit /dbgsetting
bcdedit /timeout 7
虚拟机:
增加串口硬件, 设置 output to named pipe
名字: \\.\\pipe\com_1
windbg设置:
建议快捷方式:
windbg.exe -b -k com:port=\\.\pipe\com_1,baud=115200,pipe
访问GDT的设备: Device\PhysicalMemory
IrpMon
sfilter 文件系统驱动