LiveKD, a utility I wrote for the CD included with Inside Windows 2000, 3rd Edition, is now freely available. LiveKD allows you to run the Kd and Windbg Microsoft kernel debuggers, which are part of the
Debugging Tools for Windows package, locally on a live system. Execute all the debugger commands that work on crash dump files to look deep inside the system. See the Debugging Tools for Windows documentation and our book for information on how to explore a system with the kernel debuggers.
While the latest versions of Windbg and Kd have a similar capability on Windows XP and Server 2003, LiveKD enables more functionality, such as viewing thread stacks with the !thread command, than Windbg and Kd's own live kernel debugging facility.
First download and install the Debugging Tools for Windows package from Microsoft's web site:
If you install the tools to their default directory of \Program Files\Microsoft\Debugging Tools for Windows, you can run LiveKD from any directory; otherwise you should copy LiveKD to the directory in which the tools are installed.
If you haven't installed symbols for the system on which you run LiveKD, LiveKD will ask if you want it to automatically configure the system to use Microsoft's symbol server (see the Debugging Tools for Windows documentation for information on symbol files and the Microsoft symbol server).
NOTE: The Microsoft debugger will complain that it can't find symbols for LIVEKDD.SYS. This is expected, since I have not made symbols for LIVEKDD.SYS available, and does not affect the behavior of the debugger.
usage: LiveKd [-w] [-k <debugger>] [-o filename] [[-hv <VM name>] [-p] | [-hvl]] [-m [flags]] [-mp process|pid] [debugger options]
| -w ||Runs windbg instead of kd.|
| -k ||Specifies complete path and filename of debugger image to execute.|
| -m ||Creates a mirror dump, which is a consistent view of kernel memory.|
Only kernel mode memory will be available, and this option may need significant amounts of available physical memory. A flags mask that specifies which regions to include may optionally be provided (drawn from the following table, default 0x18F8):
0001 - process private, 0002 - mapped file, 0004 - shared section
0008 - page table pages, 0010 - paged pool, 0020 - non-paged pool
0040 - system PTEs, 0080 - session pages, 0100 - metadata files
0200 - AWE user pages, 0400 - driver pages, 0800 - kernel stacks
1000 - WS metadata, 2000 - large pages
The default captures most kernel memory contents and is recommended.
This option may be used with -o to save faster, consistent dumps.
Mirror dumps require Windows Vista or Windows Server 2008 or above.
Sysinternals RamMap provides a graphical summary of the distribution of the available memory regions that can be selected for inclusion.
| -mp ||Specifies a single process whose user mode memory contents should be included in a mirror dump. Only effective with the -m option.|
| -o ||Saves a memory.dmp to disk instead of launching the debugger.|
| -p||Pauses the target Hyper-V VM while LiveKd is active. (recommended for use with -o)|
| -hv||Specifies the name or GUID of the Hyper-V VM to debug.|
| -hvl||Lists the names and GUIDs of running Hyper-V VMs.|
| -vsym||Displays verbose debugging information about symbol load operations.|
All other options are passed through to the debugger.
Note: Use Ctrl-Break to terminate and restart the debugger if it hangs.
By default LiveKd runs kd.exe.