Can not debug a driver, that was started/installed with Service Control Manager

NTDEV
1

Earlier I had to adjust some features of some other existing drivers. This is a longer time ago.
I remembber those drivers has been installed via *.inf files. And I was able to debug those drivers
with the WinDbg. And adjust them as wanted. But this is now a longer time ago.

Now I got the task to adjust an other existing driver, which is started / installed with the SCM.

Either via batch command:
sc create MyDriverName binPath= %WINDIR%\system32\drivers\MyDriverName.sys start= system type= kernel

or in an setup function of an application:
//create service
SC_HANDLE man=OpenSCManager(0,0,SC_MANAGER_ALL_ACCESS);
SC_HANDLE t=CreateService(man,“MyDriverName”,“MyDriverName”,SERVICE_START|SERVICE_STOP,SERVICE_KERNEL_DRIVER,SERVICE_DEMAND_START,SERVICE_ERROR_NORMAL,EntirePath,0,0,0,0,0);
StartService(t,0,0);
CloseServiceHandle(t);

Both ways of the setup work properly. After installing & starting the driver, an application that belongs to
the driver can properly communicated with the driver (sent IOCTLs do their work… ).

Now I have to debug this driver. But their are two problems:

  1. the “lm” commmand in WinDbg does not list my driver, even I can see that my driver works.
  2. Opening source file & pressing F9 leads to the following error message “Code not found. Break point not set”

I set the following three paths ( _NT_SYMBOL_PATH, _NT_EXECUTABLE_IMAGE_PATH & set _NT_SOURCE_PATH ) to the correct paths. In WinDbg I
checked that ( by pressing ctrl+s, ctrl+p & ctrl+i ).

But anyway the two described problems exists.

  1. What might be the reason( s ) ?

  2. Can you please give me a check list of points that I have to check, try out… to fix the described problems & to be able to debug my driver.

Thanks in advance for your help.

2

xxxxx@live.com wrote:

Both ways of the setup work properly. After installing & starting the driver, an application that belongs to the driver can properly communicated with the driver (sent IOCTLs do their work… ).

Now I have to debug this driver. But their are two problems:

  1. the “lm” commmand in WinDbg does not list my driver, even I can see that my driver works.
  2. Opening source file & pressing F9 leads to the following error message “Code not found. Break point not set”

I set the following three paths ( _NT_SYMBOL_PATH, _NT_EXECUTABLE_IMAGE_PATH & set _NT_SOURCE_PATH ) to the correct paths. In WinDbg I checked that ( by pressing ctrl+s, ctrl+p & ctrl+i ).

But anyway the two described problems exists.

  1. What might be the reason( s ) ?

  2. Can you please give me a check list of points that I have to check, try out… to fix the described problems & to be able to debug my driver.

Are you doing two-machine debugging, or are you trying to use local
kernel debugging? Are you running windbg on the same machine where you
built the driver? Are you running the “checked” build of your driver?
Are you sure the symbol path points to the objchk_xxx\yyy directory?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

>Are you sure the symbol path points to the objchk_xxx\yyy directory?

When you run Windbg on the same machine you built the driver, the PDB path in the binary will point straight to the build directory. No special hint in the symbol path necessary.