Command view can't see any dbgprint message

1

I am analysing HEVD (a driver app, debug version) on my host Windows 10 1803 and I use Windbg Preview from Microsoft Store.

The debug target is Win7 Pro x86 SP1 in VMWare.

No matter I try ed Kd_DEFAULT_MASK 8 (or 0xf or 0xffffffff), or add DEFAULT (value 8 or 0xf or 0xffffffff) at HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter, it doesn't work.

enter image description here

enter image description here

As you can see, the driver app is working. But I can't receive any dbgprint message.


Add:

I use virtualkd to open the debug port(I think it doesn't matter and even if I don't use virtualkd to open the debug port, it still doesn't work)

And when I use the regedit method, it will have the error message Fail to read system\currentcontrolset\services\Lmhosts\Parameters\EnableUserMode, error=2


Add:

Thanks for @Thomas Weller's reply.

It's strange, only if I run debugview at the debug target machine I can receive the dbgprint at the windbg preview in my host machine. Does anyone know why?

And there is another not important question: after I input command, there is usually a output message DBGHELP: HEVD is not source indexed as you can see in the picture. Does anyone know what it means and how to fix it?

windows
debugging
windbg
asked on Stack Overflow Aug 26, 2019 by 50u1w4y • edited Aug 27, 2019 by 50u1w4y

1 Answer

0

Create a DWORD value IHVDRIVER under HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter and set the value to 0xf.

answered on Stack Overflow Aug 28, 2019 by user11989064

User contributions licensed under CC BY-SA 3.0