Can't see output from DbgPrint

Michael_Rolle

This is certainly WinDbg 101 stuff, but the things I read in the Help file aren't sufficient.
1. Fired up WinDbg. Opened a window to local Kernel (File->Kernel Debug...->Local tab->OK).
2. ed Kd_IHVDRIVER_Mask, value is already 0xffffffff.
3. In the DriverEntry function, I call DbgPrintEx (DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, fmt, args...);
4. Start the driver using the SC START command.
5. Nothing in the WinDbg session window.
6. !dbgprint says the DbgPrint buffer is empty.

By the way, if I close the session window, File->Kernel Debug... remains grayed out, and I have to quit WinDbg and start it again if I want to repeat the above. What am I doing wrong here, and is this a clue regarding the missing debug output?

I have WinDbg 10.0.17763.1 AMD64, and Windows 10 OS 1803.

raj_r

(File->Kernel Debug...->Local tab->OK

i don't think that would deliver the dbgprints for a local driver in
local machine


you probably need to have a real kernel debugging connection and
windbg on the other end to recieve the dbgprints

if you need a dbgprint on the same machine try the Debugview utility
(both sysinternals and osr had one and it worked great until win7 i
havent used them lately in newer os so cant say if there are problems
using them in win-X a quick google land a thread here which doesn't
have a followup for osr's dbgview and a stackoverflow thread that
says sysinternals also has problems in WIN-X

https://stackoverflow.com/questions/31638438/debugview-doesnt-work-on-windows-10

https://community.osr.com/discussion/274977/dbgview-trouble

Michael_Rolle

Thanks, this works. I ran dbgview and I see the debug output.

The problem mentioned in the above https://community.osr.com/discussion/274977/dbgview-trouble link is still there 6 years later, and I posted a comment there to that effect.

Michael_Rolle

The above post says that you can rename dbgv.sys, and then dbgview will work again.
To that I would add that (1) dbgview will continue to capture kernel every time it is launched, but (2) after a reboot, you have to start over (that is, run dbgview, close it, rename dbgv.sys).
I've added this comment to that post as well.