Using a Kernel Mode Debugger During Boot (Windows Embedded Standard 2009)
4/23/2012
You can use a kernel mode debugger on a headless device to monitor the boot process.
To use a kernel-mode debugger during the boot process
Before First Agent Boot (FBA) runs for the first time, add the appropriate parameters to your Boot.ini file. The following example shows the parameters.
/debug /debugport=com1 /baudrate=115200Connect a remote debugger to your target system using a serial cable.
Use the debugger to monitor FBA status of the headless system.
The headless system reboots one or more times during this process.
When the message "[FBA] Leaving Run Mode" is displayed, FBA has completed, and the OS has installed and is running on the headless system.
To view the drivers that are loaded, use the debugger to break into the OS, and then use the !drivers command.
Confirm that the Tsddd.dll driver loaded on your headless system instead of Vga.sys. For details, see the following example of a kernel-mode debugger session. For information about kernel debugging, see this Microsoft Web site.
The following log file output example shows a kernel-mode debugger session using the WinDBG debugger.
Microsoft (R) Windows Kernel Debugger Version 4.0.0011.0
Copyright (c) Microsoft Corporation. All rights reserved.
PRE FBA BOOT
Waiting to reconnect...
Loaded dbghelp extension DLL
Loaded ext extension DLL
Loaded exts extension DLL
Loaded kext extension DLL
Loaded kdexts extension DLL
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is: c:\release
Executable search path is:
PsLoadedModuleList not initialized yet. Delay kernel load.
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpclient.010817-1148
Kernel base = 0x804d0000 PsLoadedModuleList = 0x80545b28
System Uptime: not available
13:10:12 PM - [FBASetProgressText] Initializing...
13:10:12 PM - [CallEntryPointThread] C:\WINDOWS\FBA\fbalib.dll, FBAInitialize
13:10:12 PM - [FBASetProgressText] Setting SystemPrefix...
13:10:12 PM - [FBAPidGen] LoadLibrary failed for PIDGEN.DLL!
13:10:13 PM - [FBASetProductKey] ProductId Empty!
13:10:18 PM - [CallEntryPointThread] C:\WINDOWS\FBA\fbalib.dll, FBAStep1
13:10:18 PM - [CallEntryPointThread] C:\WINDOWS\FBA\fbalib.dll, FBASetSetupInfo
13:10:18 PM - [FBASetProgressText] Installing Components...
13:10:18 PM - [FBAChangeDisplaySettings] Settings: [800, 600, 32, 60]
13:10:18 PM - [FBAChangeDisplaySettings] Settings not found!
13:10:18 PM - [CallEntryPointThread] C:\WINDOWS\FBA\fbalib.dll, FBAChangeDisplaySettings
13:10:18 PM - [FBASetProgressText] Resetting Setup Flag...
13:10:18 PM - [FBARemoveRestart] Updated BootExecute!
13:10:18 PM - [CallEntryPointThread] C:\WINDOWS\FBA\fbalib.dll, FBAResetSetup
13:10:18 PM - [FBASetProgressText] Replacing System Hives...
13:10:18 PM - [FBASaveAndReplaceSystemHives] GetDefaultUserProfileDirectory failed
13:10:18 PM - [FBAFlushFilesToDisk] FlushFileBuffers(C:\) succeeded!
13:10:18 PM - [FBADoReboot] Sleeping...
13:10:28 PM - [FBADoReboot] Exiting process...
Shutdown occurred...unloading all symbol tables.
Unloading dbghelp extension DLL
Unloading ext extension DLL
Unloading exts extension DLL
Unloading kext extension DLL
Unloading kdexts extension DLL
Loaded dbghelp extension DLL
Loaded ext extension DLL
Loaded exts extension DLL
Loaded kext extension DLL
Loaded kdexts extension DLL
POST FBA BOOT
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is: c:\release
Executable search path is:
PsLoadedModuleList not initialized yet. Delay kernel load.
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpclient.010817-1148
Kernel base = 0x804d0000 PsLoadedModuleList = 0x80545b28
System Uptime: not available
13:14:38 PM - [FBA] Entering Run Mode
13:14:38 PM - [FBA] Leaving Run Mode
Break instruction exception - code 80000003 (first chance)
***************************************************************************** * * * You are seeing this message because you pressed either * * CTRL+C (if you run kd.exe) or, * * CTRL+BREAK (if you run WinDBG), * * on your debugger computer's keyboard. * * * * THIS IS NOT A BUG OR A SYSTEM CRASH * * * * If you did not intend to break into the debugger, press the G key, then * * press the ENTER key now. This message might immediately reappear. If it * * does, press G and ENTER again. * * * ***************************************************************************** *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe - nt!DbgBreakPointWithStatus+4: 8050d064 cc int 3 kd> !drivers Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe - System Driver and Image Summary Base Code Size Data Size Image Name Creation Time 804d0000 198f00 (1636 k) 4aa80 (299 k) ntoskrnl.exe Fri Aug 17 20:39:59 2001 806b4000 15d00 ( 88 k) 3000 ( 12 k) hal.dll Fri Aug 17 13:48:33 2001 fc9bb000 1100 ( 5 k) 780 ( 2 k) KDCOM.DLL Fri Aug 17 13:49:10 2001 fc8cb000 1800 ( 6 k) 1500 ( 6 k) BOOTVID.dll Fri Aug 17 13:49:09 2001 fc4bb000 c500 ( 50 k) 2c00 ( 11 k) pci.sys Fri Aug 17 13:58:04 2001 fc4cb000 7200 ( 29 k) 1700 ( 6 k) isapnp.sys Fri Aug 17 13:58:01 2001 fc4db000 8300 ( 33 k) c80 ( 4 k) MountMgr.sys Fri Aug 17 13:47:36 2001 fc47b000 1b700 ( 110 k) 2e00 ( 12 k) ftdisk.sys Fri Aug 17 13:52:41 2001 fc9bd000 800 ( 2 k) 600 ( 2 k) WMILIB.SYS Fri Aug 17 14:07:23 2001 fc73b000 3c80 ( 16 k) 980 ( 3 k) PartMgr.sys Fri Aug 17 18:32:23 2001 fc9bf000 900 ( 3 k) 600 ( 2 k) intelide.sys Fri Aug 17 13:51:45 2001 fc743000 4b00 ( 19 k) e00 ( 4 k) PCIIDEX.SYS Fri Aug 17 13:51:46 2001 fc465000 12680 ( 74 k) 2880 ( 11 k) atapi.sys Fri Aug 17 13:51:49 2001 fc441000 20900 ( 131 k) 2980 ( 11 k) Fastfat.sys Fri Aug 17 20:39:54 2001 fc419000 21c00 ( 135 k) 5680 ( 22 k) NDIS.sys Fri Aug 17 18:31:13 2001 fc4eb000 6f80 ( 28 k) 1080 ( 5 k) disk.sys Fri Aug 17 13:52:31 2001 fc4fb000 9700 ( 38 k) 1500 ( 6 k) CLASSPNP.SYS Fri Aug 17 18:32:31 2001 fc3f7000 e00 ( 4 k) 20600 (130 k) update.sys Fri Aug 17 20:53:56 2001 fc50b000 9200 ( 37 k) 3180 ( 13 k) i8042prt.sys Fri Aug 17 20:44:51 2001 fc75b000 4100 ( 17 k) 1780 ( 6 k) kbdclass.sys Fri Aug 17 13:47:47 2001 fc9c9000 1580 ( 6 k) 680 ( 2 k) Fs_Rec.SYS Fri Aug 17 13:49:37 2001 fc51b000 ca00 ( 51 k) 3080 ( 13 k) VIDEOPRT.SYS Fri Aug 17 13:57:42 2001 fc76b000 6380 ( 25 k) d00 ( 4 k) Npfs.SYS Fri Aug 17 13:50:03 2001 bf800000 0 ( 0 k) 0 ( 0 k) win32k.sys Fri Aug 17 20:52:56 2001 bff80000 0 ( 0 k) 0 ( 0 k) dxg.sys Fri Aug 17 14:55:56 2001 fcaf4000 100 ( 1 k) 900 ( 3 k) dxgthk.sys Fri Aug 17 13:53:12 2001 bff50000 0 ( 0 k) 0 ( 0 k) TSDDD.dll Fri Aug 17 22:36:04 2001