I need to capture kernel debug messages (similar to DbgView.exe) and look for a substring
so that I can play a warning tone upon detection. Is there sample code available for this.
Also, does this take a kernel component ( a custom driver to capture kernel messages) or can all of this be done in an app?
wrote in message news:xxxxx@windbg… > I need to capture kernel debug messages (similar to DbgView.exe) and look > for a substring > so that I can play a warning tone upon detection. Is there sample code > available for this. > > Also, does this take a kernel component ( a custom driver to capture > kernel messages) or can all of this be done in an app? >
Indeed. Kd extensions are actually fairly easy, documentation
notwithstanding, and VERY useful.
Good luck,
mm
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Scott Noone
Sent: Tuesday, August 31, 2010 3:04 PM
To: Kernel Debugging Interest List
Subject: Re:[windbg] capturing debug messages in a windows app
Don’t cross post, it’s against the rules that you agreed to when you joined.
wrote in message news:xxxxx@windbg… > I need to capture kernel debug messages (similar to DbgView.exe) and look > for a substring > so that I can play a warning tone upon detection. Is there sample code > available for this. > > Also, does this take a kernel component ( a custom driver to capture > kernel messages) or can all of this be done in an app? >
This is to work with a driver that cannot be changed. There is no debugger connected when the technician uses this station. I need to implement this in an app or an app plus an auxillary driver if needed.
You could write an ‘application’ using the same API as an extension that
could capture USER messages pretty easily.
mm
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Tuesday, August 31, 2010 3:28 PM
To: Kernel Debugging Interest List
Subject: RE:[windbg] capturing debug messages in a windows app
This is to work with a driver that cannot be changed. There is no debugger
connected when the technician uses this station. I need to implement this
in an app or an app plus an auxillary driver if needed.
one approach could be to use DebugView and log the kernel messages into a file. Then have a second user mode application which looks at this file and scans for the substring on every file change or periodically.
I need to capture kernel debug messages (similar to DbgView.exe) and look for a substring
so that I can play a warning tone upon detection. Is there sample code available for this.
There’s a app called Dbwin32 by Andrew Tucker that does
this. I believe it’s a 32bit port of the original 16bit
dbwin.exe, but googling finds a couple of hits that look
like they may have src.
“Paul Attryde” wrote in message news:xxxxx@windbg… > On 31-Aug-2010 14:43, xxxxx@yahoo.com wrote: >> I need to capture kernel debug messages (similar to DbgView.exe) and look >> for a substring >> so that I can play a warning tone upon detection. Is there sample code >> available for this. >> > There’s a app called Dbwin32 by Andrew Tucker that does this. I believe > it’s a 32bit port of the original 16bit dbwin.exe, but googling finds a > couple of hits that look like they may have src. > > hth, > Paul
Wake up, dreamer! Windows no longer uses shared memory for these debug messages. –pa
OutputDebugString will still use the dbwin shared section (if it’s present).
S
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A.
Sent: Thursday, September 02, 2010 3:00 PM
To: Kernel Debugging Interest List
Subject: Re:[windbg] capturing debug messages in a windows app
“Paul Attryde” wrote in message news:xxxxx@windbg… > On 31-Aug-2010 14:43, xxxxx@yahoo.com wrote: >> I need to capture kernel debug messages (similar to DbgView.exe) and >> look for a substring so that I can play a warning tone upon >> detection. Is there sample code available for this. >> > There’s a app called Dbwin32 by Andrew Tucker that does this. I > believe it’s a 32bit port of the original 16bit dbwin.exe, but > googling finds a couple of hits that look like they may have src. > > hth, > Paul
Wake up, dreamer! Windows no longer uses shared memory for these debug messages. –pa