Windows Kernel Debugger API?...accessing strings

Question

How can you read Windows kernel debugger strings generated by calls to kdPrint or debugPrint functions?

Reading in user mode especially, but it is also good in kernel mode!

It's the same thing as DebugView does, but I want to filter and to work only with certain messages (strings) given to the debugger.

Answer 1

In user mode, you have the DBWIN "API":

1. Create a named ("DBWIN_BUFFER") shared memory region (4096 bytes, first DWORD is the process pid) and two events
2. Signal the DBWIN_BUFFER_READY named event
3. Wait for the DBWIN_DATA_READY named event
4. Read shared memory (And go to step #2 to get the next output)

In kernel mode on NT6 you have DbgSetDebugPrintCallback

On older stuff, you need to do some sort of hooking (int 0x2d / DebugService) The best place to find more help about that is probably the OSR newsgroup.

Edit: On Vista and later, you need to set the Debug Print Filter registry entry to enable debug output messages from DbgPrint[Ex] (For KdPrint you need a kernel debugger IIRC)