Kernel driver development - Remote debugging target machine (Hypervisor VM) with WinDbg

[T Morrison]

Hello,


Trying to setup a debug environment to test a mini filter driver I'm working on.

I've followed

Setting Up KDNET Network Kernel Debugging Automatically - Windows drivers



In my case I have my target hosted inside a VM which lives on my host machine. If I run kdnet on the target I get:

c:\kdnet>kdnet

Network debugging is supported by this Microsoft Hypervisor Virtual Machine.



That doesn't quite match what was written in the docs page, but sounds positive.

On my host machine I get the IP address of my host machine by running ipconfig /all

Wireless LAN adapter Wi-Fi 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TP-Link Wireless USB Adapter
Physical Address. . . . . . . . . : 50-3E-AA-A0-0D-34
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2601:600:897f:e0d8:b9ed:e667:c416:8067(Preferred)
Temporary IPv6 Address. . . . . . : 2601:600:897f:e0d8:f03e:9270:ca18:a9fb(Deprecated)
Temporary IPv6 Address. . . . . . : 2601:600:897f:e0d8:f484:3f37:2da8:5531(Preferred)
Link-local IPv6 Address . . . . . : fe80::b9ed:e667:c416:8067%21(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.30(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Thursday, April 25, 2019 10:55:21 PM
Lease Expires . . . . . . . . . . : Saturday, April 27, 2019 7:09:17 PM
Default Gateway . . . . . . . . . : fe80::b27f:b9ff:fe79:4d7a%21
192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 676347562
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-7B-57-C8-94-DE-80-69-CC-BE
DNS Servers . . . . . . . . . . . : 2001:558:feed::1
2001:558:feed::2
75.75.75.75
75.75.76.76
2001:558:feed::1
2001:558:feed::2
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter vEthernet (Default Switch):

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter
Physical Address. . . . . . . . . : B2-15-E4-6B-D7-30
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::24dd:2aa1:53a2:4085%23(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.164.209(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.240
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 397546980
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-7B-57-C8-94-DE-80-69-CC-BE
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled


Looks like 192.168.164.209 is what I want.


So now on the target I run

kdnet.exe 192.168.0.30 50049

It gives me back a command to run from my desktop machine which boots WinDbg opens a Kernel command window and hangs with

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Using NET for debugging
Opened WinSock 2.0
Waiting to reconnect...

I checked that WinDbg has been allowed through public and private networks in my firewall config.


I further noticed I can sucessfully ping from the host to the target but not vice versa. So I went to the host's firewall inbound and enabled file and printer sharing echo request (any reason why I would not want this always enabled). Anyway that didn't help with connecting WinDbg

Any help appreciated

Continue reading...