Windows Kernel Debugging Introduction

In this video I will demonstrate how you can debug the Windows Kernel.
Dependencies:
- VirtualBox: winget install virtualbox
- windbg: winget install Microsoft.WinDbg
Links:
- Official Guide: learn.microsoft.com/en-us/win...
- Unofficial Native API Docs: ntdoc.m417z.com/

[@nirlichtman]

- I used Win7 in this video since I just had the disk around, but you can also grab the Win10 iso from the official Microsoft website and the same method from this video will work (I think it also works with Win11 but I haven't tried yet)
- Notice that after enabling debugging on the Windows boot settings, the machine will wait for a debugger connection each time it boots, you can bring it back to working normally by disabling debugging in bcdedit
- I recommend making a snapshot before starting - so you can just easily restore it to the beginning state

[@marouaniAymen]

Thanks for the great video, but how to obtain a windows to run on a virtual machine ?

[@nirlichtman]

@@marouaniAymen I just installed from a physical installation disk of Windows 7 I have, you can also debug a physical computer

[@marouaniAymen]

@@nirlichtman Thanks for your answer

[@ramorix]

Great video as always ! Keep going !

[@uschurch]

Wonderful. Hopefully many youtubers learn from you to make concise videos!

[@anonymouscommentator]

im curious as to why win 7 32bit was used. is it harder/not possible on modern versions?

[@n-uv7vg]

Same

[@jezura777]

I think he mentioned that only because the number that he passed to the function shows as pair of 2 bytes or as 32 bits in the debugger.

[@nirlichtman]

Reason I chose Win7 32bit is because that is the newest Windows installation disk I have in my room and also it has low system requirements, but this process should work the same in modern versions as well (modern versions even support additional types of kernel debugging - more info in the official docs)

[@bendono]

Arguments are passed differently between 32 and 64-bit processes. It is arguably easier to learn 32-bit first before moving on to 64-bit.

[@nonoroberto8219]

Thanks a lot for those videos about kernel debug!

[@nonoroberto8219]

I have a question though, where did you learn that stuff? Alone?

[@FilthyPitDog]

great content ✌

[@pouf-dk3nq]

windows has a really good debugger

[@nirlichtman]

Agreed, windbg is very powerful and I like the GUI as well

[@moshixmainframechannel]

Another great video !!

[@theSoberSobber]

Nice 👍

[@Tech69YT]

mine stuck at debugge not connected.
i am trying to attach to win2016 server. i get connection established but it stuck at system up time and says debuggee not connected.
i tried to break but did not work.

[@JayJay-ly4er]

thank you.

[@sauvignonblanc5086]

Is it possible to debug playstation kernel?

[@nirlichtman]

Which playstation model?

[@sauvignonblanc5086]

@@nirlichtman PS4

[@TunifyBasic]

can we still install windows 7 in 2024? i wan't an iso man.

[@nirlichtman]

I installed from a physical Win7 disk I have

[@1kvolt1978]

Yes, we can. And we will.

[@satr14-tech]

13 hours ago... wow

[@ZEROxDEADDEAD]

Last time I used windbg it offloaded the dump onto an innaccessible directory despite admin privelages. Lmao

[@R.B.]

It's all accessible when you know how. You may have to use something like Sysinternals PS tools to run a command prompt as system, but you probably only needed to take ownership and add read permissions.

[@haroldcruz8550]

Appreciate the video but it would have been better if it was for Windows 11

[@uschurch]

It's probably very similar.