内核跟踪 Windows 7 WinDbg

Kernel trace Windows 7 WinDbg

提问by grzegorz_p

I'm getting no debug information when debugging en_windows_7_checked_build_dvd_x86_398742. I can't see even my own trace info (ATLTRACE). In opposite, Windows XP Checked works like a charm. I get "Bad QueryIdType:5" msg on debug session start with Windows 7. Kernel debug is set up properly obviously. Please help...

调试 en_windows_7_checked_build_dvd_x86_398742 时，我没有得到任何调试信息。我什至看不到我自己的跟踪信息 (ATLTRACE)。相反，Windows XP Checked 就像一个魅力。我在 Windows 7 的调试会话开始时收到“Bad QueryIdType:5”消息。显然，内核调试设置正确。请帮忙...

回答by manylegged

I was able to fix it from within windbg, on windows 7 32 bit:

我能够在 windows 7 32 位上从 Windbg 中修复它：

ed Kd_DEFAULT_Mask 8

According to the msdn article, you can also use the registry, but you must reboot for it to take effect. Create a DWORD key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filtercalled DEFAULTwith a value of 8.

根据msdn文章，您也可以使用注册表，但必须重新启动才能生效。在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter调用下创建一个DEFAULT值为8.

The up to date microsoft documentation is available here: http://msdn.microsoft.com/en-us/library/windows/hardware/ff551519(v=vs.85).aspx

最新的微软文档可在此处获得：http: //msdn.microsoft.com/en-us/library/windows/hardware/ff551519(v=vs.85).aspx

回答by grzegorz_p

OK, i found the solution here. It may help people:

好的，我在这里找到了解决方案。它可以帮助人们：

The problem: Your DbgPrint or KdPrint messages don't appear in WinDbg (or KD) when you run your driver on Windows Vista.

The reason? Vista automatically maps DbgPrint and friends to DbgPrintEx. Now, you may recall that DbgPrintEx allows you to control the conditions under which messages will be sent to the kernel debugger by filtering messages via a component name and level in the function call and an associated filter mask in either the registry or in memory.

In Vista, DbgPrint and KdPrint are mapped to component "DPFLTR_DEFAULT_ID" and level "DPFLTR_INFO_LEVEL". Of course, in Vista, xxx_INFO_LEVEL output is disabled by default. So, by default, your DbgPrint/KdPrint doesn't get sent to the kernel debugger.

How to fix it? Two choices:

• Enable output of DbgPrint/KdPrint messages by default --Open the key HKLM\SYSTEM\CurrentControlSet\Session Manager\Debug Print Filter. Under this key, create a value with the name DEFAULTSet the value of this key equal to the DWORD value 8 to enable xxx_INFO_LEVEL output as well as xxx_ERROR_LEVELoutput. Or try setting the mask to 0xF so you get all output. You must reboot for these changes to take effect.

• Specifically change the component filter mast for DPFLTR. In early releases of Vista/LH you changed the default printout mask by specifying a mask value for the DWORD at Kd_DPFLTR_MASK("ed Kd_DPFLTR_MASK"). In build 5308 (the February CTP of Vista), it seems that the mask variable has changed and you need to set the mask value for the DWORD at Kd_DEFAULT_MASK("ed Kd_DEFAULT_MASK). In either case, specify 8 to enable DPFLTR_INFO_LEVELoutput in addition to DPFLTR_ERROR_LEVELoutput, or 0xF to get all levels of output.

See the WDK documentation for Reading and Filtering Debugging Messages (follow the path: Driver Development Tools\Tools for Debugging Drivers\Using Debugging Code in a Driver\Debugging Code Overview) for the complete details on the use of DbgPrintEx/KdPrintEx. Or look at the Debugging Tools For Windows documentation (Appendix A) on DbgPrintEx.

问题：当您在 Windows Vista 上运行驱动程序时，您的 DbgPrint 或 KdPrint 消息不会出现在 WinDbg（或 KD）中。

原因？Vista 自动将 DbgPrint 和朋友映射到 DbgPrintEx。现在，您可能还记得，DbgPrintEx 允许您通过函数调用中的组件名称和级别以及注册表或内存中的关联过滤器掩码过滤消息，从而控制将消息发送到内核调试器的条件。

在 Vista 中，DbgPrint 和 KdPrint 被映射到组件“DPFLTR_DEFAULT_ID”和级别“DPFLTR_INFO_LEVEL”。当然，在 Vista 中，xxx_INFO_LEVEL 输出默认是禁用的。因此，默认情况下，您的 DbgPrint/KdPrint 不会发送到内核调试器。

如何解决？两种选择：

• 默认情况下启用 DbgPrint/KdPrint 消息的输出 -- 打开密钥HKLM\SYSTEM\CurrentControlSet\Session Manager\Debug Print Filter。在此键下，创建一个名为 nameDEFAULT的值将此键的值设置为等于 DWORD 值 8 以启用 xxx_INFO_LEVEL 输出和xxx_ERROR_LEVEL输出。或者尝试将掩码设置为 0xF，以便获得所有输出。您必须重新启动才能使这些更改生效。

• 专门更改组件过滤器桅杆DPFLTR。在 Vista/LH 的早期版本中，您通过在Kd_DPFLTR_MASK("ed Kd_DPFLTR_MASK")处为 DWORD 指定掩码值来更改默认打印输出掩码。在build 5308（Vista的2月CTP）中，似乎掩码变量发生了变化，需要在Kd_DEFAULT_MASK("ed Kd_DEFAULT_MASK)处设置DWORD的掩码值。无论哪种情况，指定8以启用DPFLTR_INFO_LEVEL输出除了DPFLTR_ERROR_LEVEL输出, 或 0xF 以获得所有级别的输出。

有关使用 DbgPrintEx/KdPrintEx 的完整详细信息，请参阅读取和过滤调试消息的 WDK 文档（遵循路径：驱动程序开发工具\调试驱动程序的工具\在驱动程序中使用调试代码\调试代码概述）。或者查看 DbgPrintEx 上的 Windows 调试工具文档（附录 A）。

回答by user8504816

For enabling output of DbgPrint/KdPrint messages by default the registry path is "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" Session Manger ist below Control. The Default value normaly is 0xf. That enables all messages. To set a better fitting bitmask at your needs the informations are located at https://docs.microsoft.com/de-de/windows-hardware/drivers/devtest/reading-and-filtering-debugging-messages#identifying-the-component-name

默认情况下，为了启用 DbgPrint/KdPrint 消息的输出，注册表路径是“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter”会话管理器位于控制之下。默认值通常是 0xf。这将启用所有消息。要根据您的需要设置更合适的位掩码，信息位于 https://docs.microsoft.com/de-de/windows-hardware/drivers/devtest/reading-and-filtering-debugging-messages#identifying-the-组件名称

If you take Visual Studio 2015 or 2017, the standard configuration won't set this flag by default. When start working with examples don't forget to set this extra on the Debug-Target.

如果您使用 Visual Studio 2015 或 2017，默认情况下标准配置不会设置此标志。当开始使用示例时，不要忘记在调试目标上设置这个额外的。

So this helped me in my Windows 10 environment using Windbg.

所以这在我使用 Windbg 的 Windows 10 环境中帮助了我。

A second problem was using devcon on Windows 10 like described in the echo example https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debug-universal-drivers---step-by-step-lab--echo-kernel-mode-#install

第二个问题是在 Windows 10 上使用 devcon，如 echo 示例中所述 https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debug-universal-drivers---step-by-step -lab--echo-kernel-mode-#install

At Bullet "7 Locate the built driver files" transfering the needed driver files to the Debug-Target and load them with devcon. Using Windows 10 you also have to copy the catalog-File. Otherwise devcon.exe will fail as described. Of cause you will need to install the test-certificate as well. This is usually done when preparing the debugging environment with Visual Studio 2015/2017. Just double check with certmgr.

在项目符号“7 找到构建的驱动程序文件”中，将所需的驱动程序文件传输到调试目标并使用 devcon 加载它们。使用 Windows 10，您还必须复制目录文件。否则 devcon.exe 将如所述失败。当然，您还需要安装测试证书。这通常在使用 Visual Studio 2015/2017 准备调试环境时完成。只需仔细检查 certmgr。