Setting User Mode Break Points From Kd Aka .process /i Vs .process /r /p



When performing KD(Kernel Debugging) in Windows with Windbg if you have to set a break point in a user mode process we should always use .process /i address; g; .reload /user. Lot of good content is written on the internet on this command, but nothing seemed to explain why this command should be used instead of the familiar .process /r /p address. I would like to shed some light on this. Before reading any further I would strongly encourage you to read about it from above link. In this article I assume some basic knowledge on how kernel debugging is done with Windbg. Also, I would like to start with the following question.

If the debugger has read/write access to the user mode process via .process /r /p why cannot it insert int 3 in user mode process when performing KD? Why do we have to make the user mode process the current process context by running .process /i ?

To explain this we need to quickly understand how break points work.

How do break points work in user mode debugging

Below are the steps involved for a break point to work in debugging a user mode process.

User mode break points from KD

When debugging a user mode process from KD the steps works exactly same as above but with a slight twist.

Before break point getting updated

Setting the break point

After break point is updated

NOTE: I initially made multihasher.exe the process context by using .process /i multihasher address;g;

Setting breakpoints in system dlls

This .process /i is not required if you are putting breakpoints in system dlls like kernelbase, ntdll etc because these dlls are loaded at the same virtual address in all the user mode processes and they have a single copy in the physical memory. So once a break point set in a process the break point is visible in all other processes which uses that system dll. Below we illustrate this by setting a break point in ntdll.dll. (Even here just make sure when you broke initially you are not in System process as it will not have ntdll!)

Break point is set only in ntdll of explorer process

Break point set in ntdll of explorer gets reflected in ntdll of notepad also