0

This is a goofy one. I've got a problem in a kernel module that only happens once every 50-100 reboots, I have the line in windbg that I want to break on, and I have the test machine rebooting whenever it detects the problem hasn't happened so it can reboot and see if the failure happens next time.

The issue is that I want windbg to stop on the breakpoint in the bootup process where I can see the problem happen. But when the test machine reboots, windbg gets disconncted (as the machine is gone), and then when windows boots it connects again. It loads my workspace, but it doesn't seem to load symbols and therefore misses my breakpoints.

If I set the "cycle initial break" to on, then as soon as windbg is connected, it breaks and loads my symbols, and I hit f5 to continue and then if my breakpoint gets hit it stops. But the point is to automate this, I don't want to have to sit there and hit f5 every time the test machine reboots.

Is there a way to force windbg to load symbols on connection even if it hasn't stopped yet?

stu
  • 8,461
  • 18
  • 74
  • 112

2 Answers2

1

Yes, you can create a script file and use the "-cfr" parameter to specify your file name when you launch kd. The script file when the debugger is started, and whenever the target restarts.

In your script file, just put the .reload command and you should be good.

Documentation from Microsoft:

Debugger script files: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/using-script-files

KD command-line options (for the cfr parameter for file name) https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/kd-command-line-options

Leslie Davies
  • 4,052
  • 1
  • 16
  • 14
1

use 

sxe -c ".reload /f;g" ibp ; .reboot

this command will request an initial break when broken will load the symbols and issue a go you can also set your breakpoint as a command here and it will be acted upon like this 

kd> sxe -c ".reload /f;bp nt!IopInitializeBootDrivers;g" ibp ; .reboot

Shutdown occurred at (Wed Aug  2 13:14:49.008 2017 (UTC + 5:30))...unloading all symbol tables.

Waiting to reconnect...
Connected to Windows XP 2600 x86 compatible target at (Wed Aug  2 13:15:08.627 2017 (UTC + 5:30)), ptr64 FALSE
Kernel Debugger connection established.  (Initial Breakpoint requested)


Loading Kernel Symbols

* does, press "g" and "Enter" again.                                          *
*                                                                             *
*******************************************************************************


Breakpoint 0 hit
nt!IopInitializeBootDrivers:
806aa839 8bff            mov     edi,edi

kd> k
 # ChildEBP RetAddr  
00 fc8d3694 806a06df nt!IopInitializeBootDrivers
01 fc8d383c 806a1a6c nt!IoInitSystem+0x712
02 fc8d3dac 8057aeff nt!Phase1Initialization+0x9b5
03 fc8d3ddc 804f88ea nt!PspSystemThreadStartup+0x34
04 00000000 00000000 nt!KiThreadStartup+0x16
blabb
  • 8,674
  • 1
  • 18
  • 27
  • my existing breakpoints get pulled in with the workspace reload, so that's all there, I'm pretty sure it's just the symbols not loading that's causing the problem, because when I manually break in, .reload /f then everything goes as planned. Thanks for the tips. I'm new to windbg, didn't know about sxe. – stu Aug 03 '17 at 14:38