Unable to get program counter

I set bootdebug via bcdedit. And I rebooted. That is what I got on WinDbg

Executable search path is: 
ReadVirtual() failed in GetXStateConfiguration() first read attempt (error == 0.)
CS descriptor lookup failed
Windows Boot Debugger Kernel Version 26100 UP Free x64
Primary image base = 0x00000000`10000000 Loaded module list = 0x00000000`10291a20
System Uptime: not available
Unable to get program counter

It's Windows 11 25H2. Connected using KDNet. I'm using VMware and never seen this before. The registers (including RIP) are correct. Stack trace is correct. But p or g does nothing. It just repeats Unable to get program counter.

Have you tried updating WinDbg? Sometimes that fixes things like this. If that still doesn’t work I’d try HyperV. I was able to get it working just now with HyperV and WinDbg 10.0.26100.7175:

BD: Boot Debugger Initialized
Connected to Windows Boot Debugger 26100 x64 target at (Mon Dec 22 10:45:04.949 2025 (UTC - 5:00)), ptr64 TRUE
Kernel Debugger connection established.

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
ReadVirtual() failed in GetXStateConfiguration() first read attempt (error == 0.)
Windows Boot Debugger Kernel Version 26100 UP Free x64
Primary image base = 0x00000000`00e15000 Loaded module list = 0x00000000`0110fc58
System Uptime: not available
winload!DebugService2+0x5:
00000000`0109ee35 cc              int     3
kd> p
winload!DebugService2+0x6:
00000000`0109ee36 c3              ret
kd> p
winload!DbgLoadImageSymbols+0x62:
00000000`00e67926 4883c440        add     rsp,40h
kd> p
winload!DbgLoadImageSymbols+0x66:
00000000`00e6792a 5b              pop     rbx



I tried both legacy and Store version. Store version was up to date. Both resulted in the same. I didn't try HyperV. I don't want to spend more time. I already installed and reinstalled 5 different hypervisor solutions thinking it was about VMware's buggy EFI implementation. Which usually is the case. But haven't got a better result.

I'll try with HyperV, I think. It will take some time to set this all up again. It's such a pain to debug with HyperV. It can work for boot time, but for runtime? Just... No.

Also, I noticed that you are on winload. My WinDbg hits breakpoint on bootmgfw, not winload. Since I need to debug them both.

Ah, well, I’ve not had to do bootmgr debugging in a long time so not sure what the state of that is. Though I was a long time VMware user and find HyperV to be far more pleasant (once you get used it, that is).

The whole file sharing thing, locking when break in, etc. just makes HyperV unbearable. It's a great solution. I like it more than I like VMware. But these issues are nothing that can easily be ignored.

Don’t use an enhanced session and the system won’t lock when you break in.

For file sharing if you have an enhanced session you can just drag/drop or copy/paste to transfer. Though once you have the enhanced session you get the lock on break, which is annoying.

What I generally do is create an internal HyperV switch and have a minimal server VM on that network to serve file shares and DHCP (which makes kdnet configuration easy). I also make sure I can ssh into the VMs. It’s a bit of upfront work but doesn’t take long and then things “just work”.

Can I also share the filesystem even when Windows is not booted? VMware can do that. In EFI shell, the shared folders work without any problem. That's why I cannot resort to other solutions.

That I don’t know…Hopefully someone else here has more experience doing pre-boot debugging under HyperV.

Update: Tried Hyper-V. It literally glitched and bootlooped when I set those flags. Corrupted the machine. I decided I wasn't going to reinstall Windows again.

VirtualBox works like charm.

1 Like

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.