Need Help: can't debug CSRSS with NTSD-over-KD technique

[zhangbo]

Hi,

I need to debug CSRSS with the following guidance.
http://msdn.microsoft.com/en-us/library/cc267851.aspx

The environment is:
Vista SP1(target vmware VM)
XP SP2(host machine)
Windbg v6.11.1.404 is installed on both machines.

I take the following steps:
1. In Vista VM, enable CSRSS debugging by "Gflags /r +20000", setup kernel
debugging through COM1(\\.\pipe\com_1) by "bcdedit.exe" and reboot.
2. In Vista VM, run "ntsd --".
3. In XP, run "windbg -k com:pipe,port=\\.\pipe\com_1" to connect to the VM.

After successfully connected, I never get the "Input>" prompt of NTSD, but
the "kd>" prompt.

What's wrong with my steps? Thank you.

[Ivan Brugiolo [MSFT]]

Seems to work on my side.
Tried on a Windows 7 VM hosted on Hyper-V 2008-R2.

======================= on an elevated command prompt
C:\debuggers>ntsd --

C:\debuggers>tlist -s | findstr csrss.exe
352 csrss.exe
404 csrss.exe
3712 csrss.exe
2584 csrss.exe Title:

C:\debuggers>breakin 2584
=======================

================= in the KD session
0:008> ?a18
?a18
Evaluate expression: 2584 = 00000000`00000a18
0:008>
0:008> .breakin
.breakin
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPointWithStatus:
fffff800`0187af60 cc int 3

--

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"zhangbo" <zha...@discussions.microsoft.com> wrote in message
news:3EC6C790-1A39-407C...@microsoft.com...