Dear OSR Members
Recently, I was playing around with the local kernel debugger.
When I do “bcdedit /dbgsettings local” followed up by “bcdedit /debug ON” (while working on a pristine BCD database) and then perform a reboot I’m able to load and control the “\Device\KLDBGDRV” device.
The above mentioned is exactly true when attempted on:
–> Windows 10 Build 9926 amd64
–> Windows 8.1 Build 9600 amd64
However, it is not true for Windows 7 SP1 Build 7601 amd64.
The first problems or errors occur if I try to activate the local kernel debugger.
After issuing the command “bcdedit /dbgsettings local”, bcdedit states that the desired debugger type isn’t valid.
I then tried to manually alter the BCD00000000 key using the following reg file content:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\BCD00000000\Objects{4636856e-540f-4170-a130-a84776f4c654}\Elements\15000011]
“Element”=hex:04,00,00,00,00,00,00,00
However, after this change the computer didn’t boot anymore, so I removed the customized entry.
So my conclusion to the experienced behavior is that although there exists documented information on how to enable local kernel debugging, it is meant to target only Windows versions starting with Windows 8. Can you verify that?
The official Microsoft site looks pretty much like targeting Windows 8.1.
But on Vista and XP, it seemingly was possible, too, so what am I missing out here?
Is there any way to access the KLDBGDRV device on Windows 7 SP1 after all?
By the means of “accessing” or “controlling” I refer to sending “SYSDBG_COMMAND” commands.
Best Regards
Microwave89