Friday, August 26, 2011

Getting DbgPrint Output To Appear In Vista and Later

The problem: Your DbgPrint or KdPrint messages don't appear in WinDbg (or KD) when you run your driver on Windows Vista or Windows 7.
The reason? Versions of Windows starting with Vista automatically maps DbgPrint and friends to DbgPrintEx. Now, you may recall that DbgPrintEx allows you to control the conditions under which messages will be sent to the kernel debugger by filtering messages via a component name and level in the function call and an associated filter mask in either the registry or in memory.
In Vista, DbgPrint and KdPrint are mapped to component "DPFLTR_DEFAULT_ID" and level "DPFLTR_INFO_LEVEL". Of course, in Vista, xxx_INFO_LEVEL output is disabled by default. So, by default, your DbgPrint/KdPrint doesn't get sent to the kernel debugger.
How to fix it? Two choices:
  • Enable output of DbgPrint/KdPrint messages by default --Open the key "HKLM\SYSTEM\CCS\Control\Session Manager\Debug Print Filter". Under this key, create a value with the name "DEFAULT" Set the value of this key equal to the DWORD value 8 to enable xxx_INFO_LEVEL output as well as xxx_ERROR_LEVEL output. Or try setting the mask to 0xF so you get all output. You must reboot for these changes to take effect.
  • Specifically change the component filter mast for DPFLTR. Starting with Windows Vista (and into Windows 7) you need to set the mask value for the DWORD at Kd_DEFAULT_MASK ("ed Kd_DEFAULT_MASK"). You can specify 8 to enable DPFLTR_INFO_LEVEL output in addition to DPFLTR_ERROR_LEVEL output, or 0xF to get all levels of output.
See the WDK documentation for Reading and Filtering Debugging Messages (follow the path: Driver Development Tools\Tools for Debugging Drivers\Using Debugging Code in a Driver\Debugging Code Overview) for the complete details on the use of DbgPrintEx/KdPrintEx. Or look at the Debugging Tools For Windows documentation (Appendix A) on DbgPrintEx.
If your interested in setting the registry keys to enable output, then check out the SetDbgPrintFiltering utility at http://www.osronline.com/article.cfm?article=506.
Related Articles
Enabling Debugging on the Local Machine for Windows XP®
More on Kernel Debugging - KMODE_EXCEPTION_NOT_HANDLED
Making WinDbg Your Friend - Creating Debugger Extensions
Life Support for WinDbg - New Windows NT Support Tools
Special Win2K PnP Tracing and Checks
Choose Your Weapon: Kernel Mode Debuggers - a Choice at Last
Wild Speculation -- Debugging Another Crash Dump
Resolving Symbol Problems in WinDBG
New Verifier Pool Checks In LH
I Hooked Up The Debugger Using 1394, and NOW...

User Comments
Though Hector himself probably doesn't care, why not rate this article and share your opinion with the community!? Post Your Comment
"No KdPrint text in WinDbg on Vista SP1"
I've tried manually setting the registry keys. I've also used SetDbgPrintFiltering... but it's still not working.

I'm trying to see the KdPrint messages in WinDbg from /winddk/src/kmdf/fakemodem.sys.
I started the WinDbg, started Kernel Debug (Local) then connected my cell phone in order to initiate fakemodem.sys installation (I've changed the inf file to respond to my phone's hardware ID).
Still, where are all the trace messages?
The fakemodem.sys gets installed without problems, but I see no KdPrint messages. KdBreakpoint() works and effectively hangs the system :)
It was build using the checked environment...
Thank you.

No comments:

Post a Comment