Switch kernel mode debug to user mode debug

 1) Process context - You're not necessarily in the correct process context when you break in with the debugger, so you need to force the correct process context somehow

2) The user mode module list and symbols aren't loaded by default, but you can load them with .reload /user

You're better off using .process /i if your target is XP and later, that will actually force a switch into the target process context (you hit Go in the debugger and then the target breaks in when that process context gets swapped in). If I need to set a breakpoint in a user mode process I usually:

.process /i <process address>
g
* Debuggee runs, breaks in sometime later *
.reload /user
ba e1 foo!bar

And you should be set.

Martin gave you a link to an alternate option, where you actually run a user mode debugger on the target machine and control it via the kernel connection. Very nifty as it gives you access to the user mode debugger commands as opposed to the kernel mode debugger commands, though it requires action on the target.

 

Try using command: ".process" and ".thread". For example:
 1. for find process: !process 0 0 my_tool.exe
 2. for switch context: .process /r/p <_EPROCESS_ADDR>