Debugging TV Frame 0x25

•

0 likes•99 views

Covers VMware guest virtual machine and host WinDbg setup for kernel debugging, examining virtual machine and simulating a double fault.

Software

Frame 0x25
Presenter: Dmitry Vostokov
Sponsors
Debugging.TV

• Setting guest OS and virtual machine
for kernel debugging
• Configuring host WinDbg for kernel
debugging
• Examining the guest system
• Simulating a double fault
Topics
© 2013 Software Diagnostics Institute

Virtual Machine Setup
© 2013 Software Diagnostics Institute

Guest OS Setup
© 2013 Software Diagnostics Institute

Host WinDbg Setup
© 2013 Software Diagnostics Institute

Double Fault
© 2013 Software Diagnostics Institute
1: kd> k
Child-SP RetAddr Call Site
fffff980`00a9e968 fffff800`0184d8f3 nt!KeBugCheckEx
fffff980`00a9e970 fffff800`0184c138 nt!KiBugCheckDispatch+0x73
fffff980`00a9eab0 fffff800`0184b754 nt!KiDoubleFaultAbort+0xb8
fffff980`00ce4f80 fffff800`0184d900 nt!KiDebugTrapOrFault+0x14
fffff980`00ce5118 fffff800`0184b871 nt!KiExceptionDispatch
fffff980`00ce5120 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131
[…]
fffff980`00cea400 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131
fffff980`00cea598 fffff800`0184b871 nt!KiExceptionDispatch
fffff980`00cea5a0 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131
fffff980`00cea738 fffff800`0184b871 nt!KiExceptionDispatch
fffff980`00cea740 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131
fffff980`00cea8d8 fffff800`0184b871 nt!KiExceptionDispatch
fffff980`00cea8e0 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131
fffff980`00ceaa78 fffff800`0184bec3 nt!KiExceptionDispatch
fffff980`00ceaa80 fffff980`13ac910b nt!KiInvalidOpcodeFault+0xc3
fffff980`00ceac10 fffff980`13ac9415 spsys!SPVersion+0x237db
fffff980`00ceac50 fffff980`13ad4e6c spsys!SPVersion+0x23ae5
fffff980`00ceac90 fffff800`01859ca3 spsys!SPVersion+0x2f53c
fffff980`00ceace0 fffff800`01ae1bbb nt!ExpWorkerThread+0x12a
fffff980`00cead50 fffff800`018344f6 nt!PspSystemThreadStartup+0x5b
fffff980`00cead80 00000000`00000000 nt!KxStartSystemThread+0x16

!Ad Hardcore Software Diagnostics Training
May, 13, 2013 Philosophy of Software Diagnostics (FREE)
June 17, 2013 Pattern-Oriented Network Trace Analysis (FREE)
July, 19-22, 2013 Accelerated Windows Debugging3
July 24-29, 2013 Accelerated Windows Memory Dump Analysis
2013 The New Old Debugging
© 2013 Software Diagnostics Institute
Now Available for Booking

Debugging.TV
Now on YouTube!
http://www.youtube.com/DebuggingTV

Similar to Debugging TV Frame 0x25

VMworld 2013: ESXi Native Networking Driver Model - Delivering on Simplicity ...VMworld

Static analysis as means of improving code quality Andrey Karpov

2v0 620 Exam-vSphere 6 FoundationsIsabella789

XPDS14 - Scaling Xen's Aggregate Storage Performance - Felipe Franciosi, CitrixThe Linux Foundation

Accelerated .NET Memory Dump Analysis training public slidesDmitry Vostokov

3DConsulting_PresentationJoseph Baca

4 Node.js Gotchas: What your ops team needs to knowDynatrace

[cb22] Fight Against Malware Development Life Cycle by Shusei Tomonaga and Yu...CODE BLUE

Top Issues For Microsoft Support For Windows ServerBlauge

PhD Thesis Diogo MónicaDiogo Mónica

Pharo Virtual Machine: News from the FrontESUG

My old security advisories on HMI/SCADA and industrial software released betw...Luigi Auriemma

Debugging TV Frame 0x16Dmitry Vostokov

Varnish @ Velocity IgniteArtur Bergman

the grinder testing certificationVskills

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...Michele Orru

Qemu device prototypingYan Vugenfirer

Defcon CTF qualssnyff

SSL/TLS for Mortals (J-Fall)Maarten Mulders

NetBSD on Google Compute Engine (en)Ryo ONODERA

Similar to Debugging TV Frame 0x25 (20)

VMworld 2013: ESXi Native Networking Driver Model - Delivering on Simplicity ...

Static analysis as means of improving code quality

2v0 620 Exam-vSphere 6 Foundations

XPDS14 - Scaling Xen's Aggregate Storage Performance - Felipe Franciosi, Citrix

Accelerated .NET Memory Dump Analysis training public slides

3DConsulting_Presentation

4 Node.js Gotchas: What your ops team needs to know

[cb22] Fight Against Malware Development Life Cycle by Shusei Tomonaga and Yu...

Top Issues For Microsoft Support For Windows Server

PhD Thesis Diogo Mónica

Pharo Virtual Machine: News from the Front

My old security advisories on HMI/SCADA and industrial software released betw...

Debugging TV Frame 0x16

Varnish @ Velocity Ignite

the grinder testing certification

Rooting your internals - Exploiting Internal Network Vulns via the Browser Us...

Qemu device prototyping

Defcon CTF quals

SSL/TLS for Mortals (J-Fall)

NetBSD on Google Compute Engine (en)

Recently uploaded

%in kempton park+277-882-255-28 abortion pills for sale in kempton park masabamasaba

W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...panagenda

%in Lydenburg+277-882-255-28 abortion pills for sale in Lydenburgmasabamasaba

The Top App Development Trends Shaping the Industry in 2024-25 .pdfayushiqss

%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfonteinmasabamasaba

Exploring the Best Video Editing App.pdfproinshot.com

Introducing Microsoft’s new Enterprise Work Management (EWM) SolutionOnePlan Solutions

%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfonteinmasabamasaba

%in Durban+277-882-255-28 abortion pills for sale in Durbanmasabamasaba

Microsoft AI Transformation Partner Playbook.pdfWilly Marroquin (WillyDevNET)

Direct Style Effect Systems -The Print[A] Example- A Comprehension AidPhilip Schwarz

%in Harare+277-882-255-28 abortion pills for sale in Hararemasabamasaba

call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️Delhi Call girls

AI Mastery 201: Elevating Your Workflow with Advanced LLM TechniquesVictorSzoltysek

8257 interfacing 2 in microprocessor for btech studentsHimanshiGarg82

%in Midrand+277-882-255-28 abortion pills for sale in midrandmasabamasaba

+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...Health

%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...masabamasaba

SHRMPro HRMS Software Solutions PresentationShrmpro

Define the academic and professional writing..pdfPearlKirahMaeRagusta1

Recently uploaded (20)

%in kempton park+277-882-255-28 abortion pills for sale in kempton park

W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...

%in Lydenburg+277-882-255-28 abortion pills for sale in Lydenburg

The Top App Development Trends Shaping the Industry in 2024-25 .pdf

%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein

Exploring the Best Video Editing App.pdf

Introducing Microsoft’s new Enterprise Work Management (EWM) Solution

%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein

%in Durban+277-882-255-28 abortion pills for sale in Durban

Microsoft AI Transformation Partner Playbook.pdf

Direct Style Effect Systems -The Print[A] Example- A Comprehension Aid

%in Harare+277-882-255-28 abortion pills for sale in Harare

call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️

AI Mastery 201: Elevating Your Workflow with Advanced LLM Techniques

8257 interfacing 2 in microprocessor for btech students

%in Midrand+277-882-255-28 abortion pills for sale in midrand

+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...

%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...

SHRMPro HRMS Software Solutions Presentation

Define the academic and professional writing..pdf

Debugging TV Frame 0x25

1. Frame 0x25 Presenter: Dmitry Vostokov Sponsors Debugging.TV

2. • Setting guest OS and virtual machine for kernel debugging • Configuring host WinDbg for kernel debugging • Examining the guest system • Simulating a double fault Topics © 2013 Software Diagnostics Institute

6. Double Fault © 2013 Software Diagnostics Institute 1: kd> k Child-SP RetAddr Call Site fffff980`00a9e968 fffff800`0184d8f3 nt!KeBugCheckEx fffff980`00a9e970 fffff800`0184c138 nt!KiBugCheckDispatch+0x73 fffff980`00a9eab0 fffff800`0184b754 nt!KiDoubleFaultAbort+0xb8 fffff980`00ce4f80 fffff800`0184d900 nt!KiDebugTrapOrFault+0x14 fffff980`00ce5118 fffff800`0184b871 nt!KiExceptionDispatch fffff980`00ce5120 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131 […] fffff980`00cea400 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131 fffff980`00cea598 fffff800`0184b871 nt!KiExceptionDispatch fffff980`00cea5a0 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131 fffff980`00cea738 fffff800`0184b871 nt!KiExceptionDispatch fffff980`00cea740 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131 fffff980`00cea8d8 fffff800`0184b871 nt!KiExceptionDispatch fffff980`00cea8e0 fffff800`0184d900 nt!KiDebugTrapOrFault+0x131 fffff980`00ceaa78 fffff800`0184bec3 nt!KiExceptionDispatch fffff980`00ceaa80 fffff980`13ac910b nt!KiInvalidOpcodeFault+0xc3 fffff980`00ceac10 fffff980`13ac9415 spsys!SPVersion+0x237db fffff980`00ceac50 fffff980`13ad4e6c spsys!SPVersion+0x23ae5 fffff980`00ceac90 fffff800`01859ca3 spsys!SPVersion+0x2f53c fffff980`00ceace0 fffff800`01ae1bbb nt!ExpWorkerThread+0x12a fffff980`00cead50 fffff800`018344f6 nt!PspSystemThreadStartup+0x5b fffff980`00cead80 00000000`00000000 nt!KxStartSystemThread+0x16

7. !Ad Hardcore Software Diagnostics Training May, 13, 2013 Philosophy of Software Diagnostics (FREE) June 17, 2013 Pattern-Oriented Network Trace Analysis (FREE) July, 19-22, 2013 Accelerated Windows Debugging3 July 24-29, 2013 Accelerated Windows Memory Dump Analysis 2013 The New Old Debugging © 2013 Software Diagnostics Institute Now Available for Booking

8. Debugging.TV Now on YouTube! http://www.youtube.com/DebuggingTV

Debugging TV Frame 0x25

Recommended

Recommended

More Related Content

Similar to Debugging TV Frame 0x25

Similar to Debugging TV Frame 0x25 (20)

More from Dmitry Vostokov

More from Dmitry Vostokov (20)

Recently uploaded

Recently uploaded (20)

Debugging TV Frame 0x25