Hello. I'm new to kernel debugging. My experience is primarily with user-mode debugging. I think I know how the kernel works, but I haven't mastered WinDBG very well yet.
I currently have a sample user-mode application that, when launched (let's call it process A), launches a copy of itself in a separate process (let's call it process B). Process A is debugging process B. Because of this, I can't attach the user-mode debugger to process B. To see what's going on in the application, I decided to use WinDBG in kernel debug mode to debug user mode application.
I patched the applications a bit so that process B would get into an infinite loop. Then I launched the application in a virtual machine and connected Windbg in kernel debug mode. Then I used the following commands to get into the process and thread context I was interested in.
!process 0 0 app.exe
.process /i/r/p
g
!process -1
.thread
Next I checked to see if I was really in the right place.
u rip
Yes, indeed, I am in a place of infinite loop.
Next I tried debugging, using int3 breakpoints, hardware breakpoints, and even writing infinite loops (EBFE) into the code section and running the system with g command. But I still couldn't stop at the right place. Apparently, int3 wasn't working because process A was handling this interrupt. The infinite loop didn't work because, most likely, other threads from processes A or B started by the g command were checking the code integrity and terminating the process.
I thought the best solution for bypassing code integrity сheks would be to freeze all threads in the process except the one I'm interested in. But it's not working. Windbg in kernel debug mode rejects thread suspend commands (~* n).
Please help me. How I can use the g command to start only one thread in kernel debug mode and suspend the others?
Is there a way to block the thread scheduler?