How to enable Kernel Traces in WinDBg

Question

I have already referred to this post:

But didn't help. Issuing

ed Kd_DEFAULT_Mask 8

didn't cause any change. and I don't know how to add a DWORD here HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter called DEFAULT with a value of 8, Because I can't see Debug Print Filter under my registry?

I have a way to verify whether the debug driver for my hardware is installed or not, But even after verifying that, I can't seem to get Kernel traces in windbg. There is a tool called DbgView.exe in that I have enabled following Capture options:

Capture Win32
Capture Global Win32
Capture Kernel
Enable Verbose Kernel Output
Pass-through
Capture events

I was hoping this would enable kernel traces but without help.

Could someone tell me the standard way to doing this?

score 5 · Accepted Answer · edited Nov 11 '21 at 03:10

5

How to add Debug print key registry

:>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter"

Error: The system was unable to find the specified registry key or value

:>reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" /V DEFAULT /t REG_DWORD /d 0xf

The operation completed successfully

:>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter"

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter DEFAULT REG_DWORD 0xf

edited Nov 11 '21 at 03:10

T.s. Arun

317
5
17

answered Sep 22 '14 at 18:39

blabb

8,674
1
18
27

I didn't even know you could do "reg add" from the cmd line, very handy! – rollsch Mar 04 '18 at 05:29
1

It's "Debug Print Filter", not "Debug Print" – Konrad Feb 11 '20 at 21:09

score 2 · Answer 2 · answered Sep 22 '14 at 13:54

Have you tried setting the default mask to 0xF? Are you sure that your driver is actually generating trace messages after you have changed the kd_default_mask variable?

In terms of the registry based approach, you just create the Debug Print Filter key if it isn't already there.

score 0 · Answer 3 · edited Jan 23 '23 at 14:27

0

You need to create this key. This key does not exist by default HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter The set the Default Value to 0xf. That will enable all messages.

More information can be found in "Setting the Component Filter Mask".

There is also a description how to set this for a single debugger session

edited Jan 23 '23 at 14:27

0xC0000022L

20,597
9
86
152

answered Nov 04 '17 at 09:39

user8504816

51
4

How to enable Kernel Traces in WinDBg

3 Answers3