假如我们调试内核时,需要在kernel32中设断点。一般情况下,使用调试器中断到内核中时,当时进程和线程都是Idle,
kd> !process
PROCESS 8054a900 SessionId: none Cid: 0000 Peb: 00000000 ParentCid: 0000
DirBase: 00039000 ObjectTable: e1000d68 HandleCount: 128.
Image: Idle
VadRoot 00000000 Vads 0 Clone 0 Private 0. Modified 0. Locked 0.
DeviceMap 00000000
Token e1000820
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 01:44:44.025
QuotaPoolUsage[PagedPool] 0
QuotaPoolUsage[NonPagedPool] 0
Working Set Sizes (now,min,max) (5, 50, 450) (20KB, 200KB, 1800KB)
PeakWorkingSetSize 5
VirtualSize 0 Mb
PeakVirtualSize 0 Mb
PageFaultCount