Getting a lot of windbg messages that start with "Ldrp" during kernel debugging in boot?

brad_H

I have a win7x64 system that BSODs in the boot. So i turned on its debugging mode using F8.

But when i attach to it, even tho i have not turned on the verbose output, i am getting A LOT (more like spam) of windbg messages that start with Ldrp. So much that even after 20 minute the system hasn't booted up yet.

Some sample messages:

0334:0370 @ 00817039 - LdrpLoadImportModule - ENTER: DLL name: RPCRT4.dll DLL path: C:\Windows\system32;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\;C:\Program Files (x86)\Windows Kits\10\Tools\x86;C:\Program Files\Git\cmd;C:\Program Files\de4dot;C:\Program Files\dotnet\;C:\Program F
0334:0370 @ 00817039 - LdrpFindOrMapDll - ENTER: DLL name: RPCRT4.dll DLL path: C:\Windows\system32;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\;C:\Program Files (x86)\Windows Kits\10\Tools\x86;C:\Program Files\Git\cmd;C:\Program Files\de4dot;C:\Program Files\dotnet\;C:\Program Files
0334:0370 @ 00817070 - LdrpFindOrMapDll - RETURN: Status: 0x00000000
0334:0370 @ 00817148 - LdrpLoadImportModule - RETURN: Status: 0x00000000
0334:0370 @ 00817164 - LdrpHandleOneOldFormatImportDescriptor - INFO: DLL "C:\Windows\system32\POWRPROF.DLL" imports "SETUPAPI.dll"
0334:0370 @ 00817180 - LdrpLoadImportModule - ENTER: DLL name: SETUPAPI.dll DLL path: C:\Windows\system32;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\;C:\Program Files (x86)\Windows Kits\10\Tools\x86;C:\Program Files\Git\cmd;C:\Program Files\de4dot;C:\Program Files\dotnet\;C:\Program
0334:0370 @ 00817195 - LdrpFindOrMapDll - ENTER: DLL name: SETUPAPI.dll DLL path: C:\Windows\system32;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\;C:\Program Files (x86)\Windows Kits\10\Tools\x86;C:\Program Files\Git\cmd;C:\Program Files\de4dot;C:\Program Files\dotnet\;C:\Program Fil
0334:0370 @ 00817226 - LdrpFindOrMapDll - RETURN: Status: 0x00000000
0334:0370 @ 00817273 - LdrpLoadImportModule - RETURN: Status: 0x00000000

So what is this, and how can i stop this from getting printed and spamming my windbg?

Alan_Adams

I believe that is the output expected when "Show loader snaps" is enabled in GFLAGS for a user-mode application. See which application(s) under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] appears to have this flag turned on.
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/gflags

Peter_Viscarola_(OSR)

@Alan_Adams ... Oh, GOOD one. VERY nice observation! I never would have gotten that.

brad_H

@Alan_Adams said:
I believe that is the output expected when "Show loader snaps" is enabled in GFLAGS for a user-mode application. See which application(s) under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] appears to have this flag turned on.
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/gflags

Thank you, indeed it was because of that flag.