← ClaudeAtlas

live-kernellisted

Reach and drive a live kernel target from this bench - KDNET and serial wiring and their traps, loading and walking a driver's IOCTL dispatch (HEVD), what `.reload` does to the module inventory, and where symbols must live. Use when attaching to a kernel target, debugging a driver over KD, or diagnosing an attach that parked or symbols that will not resolve.
glslang/windbg-mcp · ★ 9 · AI & Automation · score 74
Install: claude install-skill glslang/windbg-mcp
# Live kernel and driver IOCTL work ## Two ways a target is reached, and neither is "the" procedure **KDNET.** Check the target is reachable *before* starting the tier, not by starting it — an attach that finds nothing parks its worker in `WaitForEvent(INFINITE)` for the whole run and reports a timeout that measures the environment rather than the code. What settles it is not "can I reach the guest" but **does the guest's `bcdedit /dbgsettings hostip` equal this debugger host's current IP**, on the port the profile names; the host IP moves between sessions. Compare the key by *hash* rather than printing it. *Finding* the guest is topology-specific. On the machine that paragraph was written for, the debugger host is itself a Hyper-V guest — `Get-VM` does not exist and there is no local VM to start — so the target is a *sibling*: it appears in the neighbour table (`Get-NetNeighbor | ? LinkLayerAddress -like '00-15-5D*'`) and answers **TCP 5985** and nothing else, ICMP and 445 being closed, so a failed ping proves nothing there. With several neighbours the table will happily validate the wrong guest, which is what the `hostip` comparison is for. **Serial, which is what the Parallels bench uses** — and there KDNET is not merely unconfigured but *impossible*: guests get a `Parallels VirtIO Ethernet Adapter` (`PCI\VEN_1AF4`), and `1AF4` is not in the Debugging Tools' `VerifiedNICList.xml`. `prlctl set <vm> --device-set net0 --adapter-type e1000` is accepted and silently ignored