Skip to content

Instantly share code, notes, and snippets.

@osy

osy/gist:687bbdf8e25eaf6890443a03399c265b

Last active March 28, 2025 17:01
Show Gist options
  • Save osy/687bbdf8e25eaf6890443a03399c265b to your computer and use it in GitHub Desktop.
Save osy/687bbdf8e25eaf6890443a03399c265b to your computer and use it in GitHub Desktop.
Download ZIP
WinDbg kernel debugging Windows 11 with KDNET and UTM
Raw
gistfile1.md

Host Setup

The host can be any machine on the same subnet running WinDbg. This can be a physical machine, UTM, VMware, etc. If you're running a VM as the KDNET host, make sure to use a bridged network connection.

  1. Get the host IP address with ipconfig. In our example, we will use 10.0.1.11
  2. Launch WinDbg, Start debugging -> Attach to kernel -> Net
  3. Enter port number "50000", key "1.1.1.1", and press OK

Note if you want multiple concurrent debugging sessions with different targets, choose a new port number for each one.

Target Setup

Add KDNET hardware

  1. Create and install Windows VM in UTM
  2. Open the VM settings and create a new Network device
  3. For this new device, set the Network Mode to "Bridged (Advanced)" and the Bridged Interface to either "Automatic" or the interface which can see the host.
  4. Change the Emulated Network Card to "Intel Gigagit Ethernet (e1000)
  5. Save the settings

Disable Secure Boot

  1. Start the VM
  2. When the UTM logo comes up press Esc and enter the UEFI menu
  3. Select Device Manager -> Secure Boot Configuration -> Attempt Secure Boot (press Spacebar)
  4. Go back, save and restart the VM

Configure KDNET

Follow this guide: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/setting-up-a-network-debugging-connection

  1. Open a terminal as Administrator
  2. bcdedit /debug on
  3. bcdedit /dbgsettings net hostip:10.0.1.11 port:50000 key:1.1.1.1 (change hostip and port to match the host)
  4. bcdedit /set "{dbgsettings}" busparams b.d.f where b.d.f is the bus number, device number, and function number of the adapter. You can find this in Device Manager. Note that on ARM64 builds, there is no driver for E1000 so you will just see a generic "Ethernet Controller".
  5. (Optional) bcdedit /set testsigning on if you want to load test signed drivers
  6. Reboot and it will attempt to connect to the host

Windows PE

You can also debug Windows PE. Follow this guide: https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-debug-apps?view=windows-11

For the bcdedit steps, remember to set the busparams which is missing from Microsoft's guide.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment