Kernel debugging with WinDbg

TL;DR: Set up a host/target debugger pair over net or serial, point WinDbg at Microsoft symbols, and learn the eight or nine commands (!process, !pte, !pool, !analyze, kb, dt, bp, g) that cover 90 % of kernel exploit work.

What it is

WinDbg is the canonical kernel debugger. For exploit development you usually run it on a host machine attached to a Hyper-V or VMware guest configured for kernel debugging — host breaks the guest, inspects state, and resumes. Live local kernel debug (livekd) is read-only and useful for structure exploration but not for stepping.

Preconditions / where it applies

Host Windows machine with WinDbg (latest “WinDbg Preview” / WinDbgX recommended).
Target VM with kernel debug enabled.

Technique

Configure target (run in elevated cmd on the guest).

bcdedit /debug on
bcdedit /dbgsettings net hostip:192.168.56.1 port:50000 key:1.1.1.1
shutdown /r /t 0

For VirtualBox/legacy use serial: bcdedit /dbgsettings serial debugport:1 baudrate:115200.

Attach host.

windbgx -k net:port=50000,key=1.1.1.1
.sympath SRV*c:\sym*https://msdl.microsoft.com/download/symbols
.reload /f

Core commands.

g / gh / gn — go / handled / not-handled.
bp nt!NtCreateFile — set software breakpoint by symbol.
bm vuln!* — wildcard breakpoint across exports of a module.
kb — call stack with first three args.
dt nt!_EPROCESS @$proc — pretty-print structure.
!process 0 0 — list all processes.
!process <addr> 7 — full process detail including threads.
!pte <addr> — dump page-table entries (R/W/X bits, PFN).
!pool <addr> — pool tag, allocation size, header.
!analyze -v — auto-triage a bug check.
dps @rsp L40 — dump stack with symbol resolution.
u <addr> L20 — disassemble.

Useful workflows.

Token swap demo. !process 0 0 System → grab System EPROCESS → dt nt!_EPROCESS Token <addr> → copy to current process EPROCESS using eq writes.
Driver dispatch table dump. !drvobj \driver\foo 2 lists IRP handlers; set breakpoints on each.
Pool spray observation. !poolfind tag + !poolused show how your spray lands.

Sympath gotchas. .symfix+ adds the Microsoft store quickly; if symbols silently fail, use !sym noisy to see the download URLs being tried.

Detection and defence

Production kernels disable test signing and kernel debug; bcdedit /debug off and Secure Boot prevent attaching a debugger without prior compromise.
Boot-time integrity (HVCI, Secure Boot, DMA protection) blocks DMA-attached debugging from cold.

References

Microsoft: WinDbg kernel-mode docs — official setup
Tim Misiak — WinDbg deep dives — extension blog
Connor McGarr — kernel debug tips — practical commands