4 ms·
God I bet that was fun to debug!
by satysin 10y ago
God I bet that was fun to debug!
- yuhong 10y agoI even used a checked build of NTLDR with the boot debugger to confirm.
- azinman2 10y agoWhat does "checked build" mean here?
- krallja 10y agohttps://msdn.microsoft.com/en-us/windows/hardware/drivers/devtest/checked-and-free-build-differences https://msdn.microsoft.com/en-us/windows/hardware/drivers/de... A checked build basically has optimization off and assert() on.
- RDeckard 10y agoOptimizations are still on in checked builds.
- krallja 10y agoFrom the MSDN article I linked: > Many compiler optimizations (such as stack frame elimination) are disabled in the checked build. This makes it easier to understand disassembled machine instructions, and therefore it is easier to trace the cause of problems in system software.
- deleted 10y ago[deleted]
- yuhong 10y agoBTW, the boot debugger in checked builds of NTLDR is harder to use than the one in BOOTMGR. You have to manually load symbols by reading the PE header into memory using a copy with the real mode stub removed, and you have to use F10 at the boot menu in order to break into the debugger.
- i336_ 10y agoAs someone completely naive about Windows (and particularly low-level development), I'm casually/idly curious if the DDK includes the debugging tools you used, or if I have to throw money at people to get at them. (I know the DDK exists, but not much more than that.) Also, how did you remove the real-mode stub? Hex editing, or is there a tool that will do that if fed the right combination of [obscure] options? IMHO, the best way to finish this off would be an in-depth tutorial-style blog post. You definitely get my recommendation to consider that :)
- yuhong 10y agoYes, the DDK used to include the needed debug version of NTLDR too. And yes, it is done by hex editing looking for the "MZ" signature and trimming everything before that. With BOOTMGR you just set some BCD options to enable the boot debugger.
- i336_ 10y agoOh of course, the XP DDK. And MZ-hunting makes perfect sense. Thanks for the quick reply :) and kudos for figuring out it was the bootloader, hah