3

Just messing around with WinDbg a bit. I have a couple of virtual machines set up so I can try to do some kernel debugging on a Windows XP VM.

If I wanted to catch the system at its earliest possible moment during boot, where, or on what, would I need to set the breakpoint?

romandas
  • 4,086
  • 7
  • 29
  • 33

2 Answers2

3

The earliest you can do is when KD connection is established and a first kernel module is loaded:

Break on first module load 
The debugger breaks into a restarted target computer after the first kernel 
module is loaded. (This action causes the break to occur earlier than in the 
Break on reboot state.) This command is equivalent to starting WinDbg with 
the -d command-line option.

To do that, you can either use the -d option on the command line as mentioned above, or you can press Ctrl+Alt+K in Windbg (or Ctrl+K if you use kd) to cycle through the initial breakin modes.

seva titov
  • 11,720
  • 2
  • 35
  • 54
1

Adding /break at the end of your debugging entry in boot.ini should give you a breakpoint before module loading (right after HAL initialization.)

Eonasdan
  • 7,563
  • 8
  • 55
  • 82
tony3
  • 11
  • 1