-
Book Overview & Buying
-
Table Of Contents
Ghidra Software Reverse-Engineering for Beginners - Second Edition
By :
To debug the Windows kernel of a remote machine, we will use the dbgeng-kernel launcher. The configuration options for this debugger are the same as for the local Windows debugger (dbgeng), except for the connection string arguments, which will be described later.
To be able to debug a Windows kernel using Ghidra, we need to modify the boot mode settings of the target machine whose kernel we want to debug. We will use the bcdedit tool to modify these settings using the following commands:
bcdedit /debug ON bcdedit /dbgsettings NET HOSTIP:IP PORT:54321 KEY:1.1.1.1
IP is the IP address of the machine running Ghidra. In our case, it is 192.168.0.1.
The following screenshot shows the output of running preceding commands on a nested Windows VM (note, it’s not the same Windows machine where Ghidra is running):
Figure 16.45 – Output of modifying boot setting commands to enable kernel mode debugging
After executing...