Windows sysinternals

Chapter 7 Process and Diagnostic Utilities 251
By default, LiveKd takes a snapshot of the local computer and runs Kd.exe. The –w and –k
options let you specify WinDbg.exe or any other debugger instead of Kd.exe. LiveKd passes
any additional command-line options that you specify on to the debugger, followed by –z
and the path to the simulated dump file.
To debug a Hyper-V virtual machine from the host, specify –hv and either the friendly name
or the GUID of the VM. To list the names and GUIDs of the available VMs, run LiveKd with the
–hvl option. Note that you can debug only one VM on a host at a time.
With the –o option, LiveKd just saves a kernel dump of the target system to the specified
dumpfile and doesn’t launch a debugger. This option is useful for capturing system dumps
for offline analysis. If the target is a Hyper-V VM, you can also add –p to the command line
to pause the VM while the snapshot is being captured in order to get a completely consistent
snapshot.
If you are launching a debugger and don’t specify –k and a path to a debugger, LiveKd will
find Kd.exe or WinDbg.exe if it is in one of the following locations:
■ The current directory when you start LiveKd
■ The same directory as LiveKd
■ The default installation path for the Debugging Tools (“%ProgramFiles%\Debugging
Tools for Windows (x86)” on x86 or “%ProgramFiles%\Debugging Tools for Windows
(x64)” on x64)
■ A directory specified in the PATH variable
If the _NT_SYMBOL_PATH environment variable has not been configured, LiveKd will ask if
you want it to configure the system to use Microsoft’s symbol server, and then it will ask for
the local folder in which to download symbol files (C:\Symbols by default).
Refer to the Debugging Tools documentation regarding how to use the kernel debuggers.
Note The debugger will complain that it can’t find symbols for LiveKdD.SYS. This is expected
because I have not made symbols for LiveKdD.SYS available. The lack of these symbols does not
affect the behavior of the debugger.
LiveKd Examples
This command line debugs a snapshot of the local computer, passing parameters to WinDbg
to write a log file and not to display the Save Workspace? dialog box:
livekd -w -Q -logo C:\dbg.txt
www.it-ebooks.info