I am analysing HEVD (a driver app, debug version) on my host Windows 10 1803 and I use Windbg Preview from Microsoft Store.
The debug target is Win7 Pro x86 SP1 in VMWare.
No matter I try ed Kd_DEFAULT_MASK 8
(or 0xf or 0xffffffff), or add DEFAULT (value 8 or 0xf or 0xffffffff) at HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter
, it doesn't work.
As you can see, the driver app is working. But I can't receive any dbgprint message.
Add:
I use virtualkd to open the debug port(I think it doesn't matter and even if I don't use virtualkd to open the debug port, it still doesn't work)
And when I use the regedit method, it will have the error message Fail to read system\currentcontrolset\services\Lmhosts\Parameters\EnableUserMode, error=2
Add:
Thanks for @Thomas Weller's reply.
It's strange, only if I run debugview at the debug target machine I can receive the dbgprint at the windbg preview in my host machine. Does anyone know why?
And there is another not important question: after I input command, there is usually a output message DBGHELP: HEVD is not source indexed
as you can see in the picture. Does anyone know what it means and how to fix it?
Create a DWORD value IHVDRIVER
under HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter
and set the value to 0xf.
User contributions licensed under CC BY-SA 3.0