Debugging Windows 11

I was installing my printer driver to my new Windows 11.

And I need a debugger to troubleshoot my printer driver. It is time to get a Windows Debugger for the new OS.

The Windows Debugger (WinDbg) can be used to debug kernel-mode and user-mode code, analyze crash dumps, and examine the CPU registers while the code executes. 

Before get start with Windows debugging, we need to complete 2 things.

• Download WinDbg (or WinDbg Preview)
• Download Windows Symbol Packages
  

Seem like the easiest way to get Windows symbols is to use the Microsoft public symbol server. The symbol server makes symbols available to your debugging tools as needed and make it easier to debug your code. 

After a symbol file is downloaded from the symbol server it is cached on the local computer for quick access. And Microsoft no longer publishing the offline symbol packages for Windows.

While looking for WinDBG, I also found WinDbg Preview (at MS Store).

WinDbg Preview is the latest version of WinDbg with more modern visuals, faster windows, a full-fledged scripting experience, built with the extensible debugger data model front and center. In short, simply more user friendly.

And the best part is, WinDbg Preview is available in MS Store. Simply run the cmdline below to install it.

C:\> winget install WinDbg --source msstore

Links:

• How fun is Windows?
• Debugging Tools for Windows
• Download Debugging Tools for Windows
• Getting Started with Windows Debugging
• Debugging Using WinDbg Preview
  
• WinDbg Preview 
  

Notmyfault Colors Your BSOD

Remember Make Simple Things Difficult? There is a new tool from sysinternal to customized the color of BSOD for you easily.

Goto "Blue Screen" in Designers Colors with in One Click.

Make Simple Things Difficult

Just read an article by Mark on "A Bluescreen By Any Other Color". It is an example on how to make simple things difficult.

If you prefer the simple way, go to Change Color for your BSOD and Manual BSOD to get your Red Screen of Death. :-)

SMB2 BSOD 0Day

The vulnerability was discovered by Laurent Gaffié. Here's the short description about the vulnerability:

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it’s used to identify the SMB dialect that will be used for futher communication.

Based on testing, Vista/2003/2008/Windows 7 (RC) are vulnerable to this exploit. However, Windows 2000/XP/Windows 7 (RTM) are NOT affected by this exploit.

References:

• SMB2 Negotiate Protocol Request Remote BSOD (python exploit code)
• SANS: SMB2 BSOD 0Day
• SANS:SMB2 Remote Exploit released.

BSOD Survival Guide

If you don't know what BSOD is or never see this before, then see this.

Make sure you check this out if you often get BSOD.

Related posts:

• BSOD in Olympic opening.
• Change color for your BSOD.
• Manual BSOD.
  

BSOD in Olympics Opening

A picture is worth a thousand words. The Blue Screen of Death (also known affectionately as BSOD) made it’s way to the 2008 Beijing Olympics!


Seems like the Windows XP Embedded (XPe) operating system has helped launch the 2008 Olympics in Beijing, but fails.


In case you never know what is BSOD, see some BSOD through ages. Or if you want to start customize your own BSOD, you may want to change the color and trigger it manually. Have fun!

Change Color for your BSOD

In case you don't know what is BSOD, see some BSOS through the ages.

In Windows 2000/XP/2003, each time the Windows Kernel crashes, a blue screen appears, giving the administrator some clues and information as to what has caused the error. This screen, because of its blue color and catastrophic nature, was nicknamed BSOD - Blue Screen Of Death.

Why blue - no one knows, but what I do know is the fact that the blue screen can be changed to a different color, thus creating your own YSOD or RSOD or even WSOD...

To do so follow these steps:

1. Hit Win-R (Run), and type "notepad %systemroot%\system.ini" (without the quote). Or you can run the command "sysedit" (without the quote).

2. In system.ini file, locate the [386enh] section in the file:

3. If not already present, create the following new entries:

MessageBackColor=
MessageTextColor=

and give it a value according to the following list:

• 0 = black
• 1 = blue
• 2 = green
• 3 = cyan
• 4 = red
• 5 = magenta
• 6 = yellow/brown
• 7 = white
• 8 = gray
• 9 = bright blue
• A = bright green
• B = bright cyan
• C = bright red
• D = bright magenta
• E = bright yellow
• F = bright white

For example, to have Red Screen of Death (white text):

MessageBackColor=4
MessageTextColor=F

Note: Use CAPITAL LETTERS, i.e. F and not f.

4. Save SYSTEM.INI file and restart the computer.

If you want to test it (cause the system kernel to crash), try manual BSOD.

The reason behind this tweak is for people that have certain forms of visual impairment and are only able to use Windows when it is set to high contrast mode. This setting allows the BSOD to be set to high contrast colors as well, making it easier for the visually impaired to read the information in them.

Check this http://support.microsoft.com/kb/90740

Manual BSOD

Do you know you can "cause" BSOD manually? This isn't a bug, it's a "feature" in Windows that is designed to let users trigger a crash dump for testing purposes. There's even a whole Microsoft KB article on the subject.

To enable this feature, open up regedit and then browse down to one of these keys, depending on your keyboard type:

USB Keyboard

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters

PS/2 Keyboard

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters

Now right-click on the right-hand pane and add a new DWORD key named CrashOnCtrlScroll, giving it a value of 1.

Reboot your computer, and when it starts back up you can trigger the Blue Screen of Death by using the following keyboard shortcut:

 Hold down Right Ctrl and hit Scroll Lock twice

To remove this "feature" you can just delete the registry key and then restart your computer again.