OutputDebugString question

NTDEV
1

Hi, All

I wrote a user mode dll.

In this dll,
there is a OutputDebugString call.

I found this case:

some time, the print is to the debugview of the target PC

some times, the print is to the host pc by the kernel live debug.

I am not sure the rule of this?

Can anyone tell the secrets?

2

On Jan 11, 2015, at 11:23 PM, workingmailing@163.com wrote:

I wrote a user mode dll.

In this dll,
there is a OutputDebugString call.

I found this case:

some time, the print is to the debugview of the target PC

some times, the print is to the host pc by the kernel live debug.

I am not sure the rule of this?

I don’t think there is a rule. You have two consumers trying to consume the same resource. It’s likely just a matter of timing.

Why would you want to run both?
—
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Hi, Tim,

I just find this case

sometimes, it output to the DebugView at the target PC.

sometimes, it output to the host pc by windebug live kernel debug.

So I found this is a interesting case and ask this questions.

4

But if close the DebugView on the target PC, there is no output at Windbg of host PC, this time.

5

Generally it is printed to the user-mode debugger if it is present, and to kernel mode one otherwise.

wrote in message news:xxxxx@ntdev…
> Hi, All
>
> I wrote a user mode dll.
>
> In this dll,
> there is a OutputDebugString call.
>
> I found this case:
>
> some time, the print is to the debugview of the target PC
>
> some times, the print is to the host pc by the kernel live debug.
>
> I am not sure the rule of this?
>
> Can anyone tell the secrets?
>
>
>
>
>

6

so why even I close the debugview.exe at the target side.
there is not output at the kernel mode debugger?

But I do watch the case the string output to the kernel mode debugger.