Walkthrough debugging BSODs during Windows installation

1. Debugging BSODs during Windows installation
Igor Derzhavets, igord@daynix.com
Yan Vugenfirer, yan@daynix.com
Daynix Computing LTD

2. Daynix Computing LTD
Agenda
Motivation
Walkthrough guide

3. Daynix Computing LTD
Motivation
On a new hardware or with new features of the
hypervisor Windows might crash or hang during
the installation
Enable live debugging
Enable gathering and analysis of crash dumps

4. Daynix Computing LTD
Configuring debuggee
Extract the content of installation media to your local directory
([PATH])
Use bcdedit.exe from target OS or later
Enable serial debugging:
bcdedit.exe -store [PATH]bootbcd /set "{default}" debug on
Enable serial port debug transport (can be USB or Net):
bcdedit.exe -store [PATH]bootbcd /dbgsettings SERIAL
DEBUGPORT:1 BAUDRATE:115200

5. Daynix Computing LTD
Repackaging the media
Install Windows Assessment and Deployment Kit (ADK)
- http://www.microsoft.com/en-us/download/
details.aspx?id=30652
Create ISO image for debugged installation by oscdimg
utility from ADK:
oscdimg.exe –l[Disc_Label] -m -u2 –b[PATH]boot
etfsboot.com [PATH] RemasterdWinInstall.iso

6. Daynix Computing LTD
Configuring the debugger host
Start WinDbg host VM or run WinDbg on physical
machine connected to debuggee)
Add the following to QEMU command line:
-chardev socket,id=serial0,path=/tmp/1022895-
serial0,server,nowait -device isa-
serial,chardev=serial0,id=serial0

7. Daynix Computing LTD
Install from media and debug
If using QEMU, run guest with following command
line addition:
-chardev socket,id=serial0,path=/tmp/1022895-
serial0 -device isa-
serial,chardev=serial0,id=serial0

8. Daynix Computing LTD
Running WinDbg
Run WinDbg on the
debugging host
Start kernel debug from
"File->Kernel Debug...-
>COM" menu with shown
settings
Use .dump command to
create crash dump if
needed

9. Daynix Computing LTD
Links
Kernel debugging over serial: https://
msdn.microsoft.com/en-us/library/windows/hardware/
ff556867(v=vs.85).aspx
How to create bootable Windows 8 ISO DVD using
Oscdimg.exe: http://www.windowsvalley.com/create-
bootable-windows-8-iso-dvd/Edit
Kernel Debugging with Qemu and WinDbg: http://
resources.infosecinstitute.com/kernel-debugging-
qemu-windbg/

10. Happy debugging
45