The file name of my driver is mydriver-pci.sys, but the module name in
debugger (lm) is “mydriver_pci” ( - changed to _).
Because of this (?) delayed breakpoints are not hit.
I cannot find “mydriver_pci” anywhere in my sources or INF.
So who does this and why? Is the “-” char invalid in module names?
Thanks,
– pa
The debugger is renaming your module on-the-fly. The reason is because module names can be used in dbgeng-MASM expressions, and the ‘-’ character is a valid expression operator. So the evaluation “? mydriver-pci” would actually tell you the distance between the base address of a module named “mydriver” and the base address of pci.sys. Rather than deal with all that mess, the debugger simply s/[^\w]/_/g.
The debugger carefully distinguishes between the *image file* name (i.e., the actual name, as it is known to you and the kernel) and the *module* name, which is essentially a string used by the debugger to unambiguously refer to a module (or rather, its base address). Although the module name is usually reminiscent of the image file name, they differ if needed for character substitution, uniqueness, and truncation of the file extension. Use “lmf” to see a table mapping the module name to an image file name.
How do you work around it? The path of least resistance is to play along with the debugger’s charade and refer to your module as “mydriver_pci”.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Sunday, February 26, 2012 9:08 AM
To: Kernel Debugging Interest List
Subject: [windbg] Can kernel module name contain “-” ?
The file name of my driver is mydriver-pci.sys, but the module name in debugger (lm) is “mydriver_pci” ( - changed to _).
Because of this (?) delayed breakpoints are not hit.
I cannot find “mydriver_pci” anywhere in my sources or INF.
So who does this and why? Is the “-” char invalid in module names?
Thanks,
– pa
WINDBG is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Thanks, Jeffrey.
Taken the path of least resistance (renamed the file).
On 27-Feb-2012 00:02, Jeffrey Tippet wrote:
The debugger is renaming your module on-the-fly. The reason is because module names can be used in dbgeng-MASM expressions, and the ‘-’ character is a valid expression operator. So the evaluation “? mydriver-pci” would actually tell you the distance between the base address of a module named “mydriver” and the base address of pci.sys. Rather than deal with all that mess, the debugger simply s/[^\w]/_/g.
The debugger carefully distinguishes between the *image file* name (i.e., the actual name, as it is known to you and the kernel) and the *module* name, which is essentially a string used by the debugger to unambiguously refer to a module (or rather, its base address). Although the module name is usually reminiscent of the image file name, they differ if needed for character substitution, uniqueness, and truncation of the file extension. Use “lmf” to see a table mapping the module name to an image file name.
How do you work around it? The path of least resistance is to play along with the debugger’s charade and refer to your module as “mydriver_pci”.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A
Sent: Sunday, February 26, 2012 9:08 AM
To: Kernel Debugging Interest List
Subject: [windbg] Can kernel module name contain “-” ?The file name of my driver is mydriver-pci.sys, but the module name in debugger (lm) is “mydriver_pci” ( - changed to _).
Because of this (?) delayed breakpoints are not hit.I cannot find “mydriver_pci” anywhere in my sources or INF.
So who does this and why? Is the “-” char invalid in module names?Thanks,
– pa