On 11/12/2017 14:21, Mihail Abakumov wrote:
How it works:
The WinDbg debugger has the possibility of connecting to a remote
debug service
(Kdsrv.exe) in the Windows kernel. Therefore, it is possible to
connect to the
guest system running in the QEMU emulator. Kernel debugging is
possible only
with the enabled debugging mode, may change at the same time. Our
module of
WinDbg debugger for QEMU is an alternative of the remote debugging
service in
the kernel. Thus, the debugger connects to the debugging module, not
to the
kernel of the operating system. The module obtains all the necessary
information
answering debugger requests from the QEMU emulator. At the same time
for
debugging there is no need to enable debugging mode in the kernel.
This leads to
hidden debugging. Our module supports all features of WinDbg regarding
remote
debugging, besides interception of events and exceptions. Only i386 is
supported
now.
How hard would it be to support x86_64? I'm not sure how useful this
is
for 32-bit only.
Paolo