How to break when a DLL is loaded in kernel debugger mode?

Question

In user mode debugging, I usually break with the following command:

sxe ld Something.dll

I tried the same in kernel mode, but it is not working. Is there a different command?

would setting an unresolved breakpoint on the entry point work: `bu Something!_DllMainCRTStartup` or `bu Something!DllMain`? — EdChum, Jul 10 '14 at 07:44

score 5 · Answer 1 · answered Sep 08 '16 at 18:10

5

You will want to run:

!gflag +ksl
sxe ld Something.dll
g

You may also want to refer to [1], which discussing breaking into a process near boot-time using the above approach.

answered Sep 08 '16 at 18:10

Eagle

Works like a charm. This should be the accepted answer – Jordan Mar 15 '18 at 17:50
This does not seem to work for me. I'm trying to break into a DLL that is loaded as part of a scheduled task that happens at logon, but the kernel debugger never breaks in. – Mitch Lindgren May 21 '20 at 03:27

score 1 · Answer 2 · answered Jul 10 '14 at 05:02

While doing kernel mode debugging : using sxe you will be able to break ONLY for kernel mode binaries like *.sys file.

Not for user mode binaries like *.dll

If you share what you are trying achieve may be we can find some other way to achieve that !

2 Answers2