title: How to debug a Windows kernel driver properly?
body: <p>I'm trying to set up the environment of <em>Windows</em> VM for debugging a kernel driver.</p>
  
  <p>I created a sample of kernel driver in Visual Studio 2017. <strong>File->New Project->Kernel Mode Driver</strong> (<em>basic project</em>; just for testing - autogenerated trace macro, required procedures, etc.) and want to test it on the <em>target machine</em>.</p>
  
  <p>There are my steps (<em>target machine</em>):</p>
  
  <ol>
  <li>Install Windows 10 to a virtual machine (VirtualBox);</li>
  <li><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option" rel="noreferrer">Turn on Test mode</a> and set <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--dbgsettings" rel="noreferrer">BCDEdit as local</a>;</li>
  <li>Install <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk" rel="noreferrer">WDK</a>;</li>
  <li>Download <a href="https://www.osronline.com/article.cfm?article=157" rel="noreferrer">OSR Loader</a>;</li>
  <li>Copy files after a building to a VM (C:\DriverTest\TestKernelDriver2\; <strong>.cer</strong>, <strong>.inf</strong>, <strong>.pdb</strong>, <strong>.sys</strong>);</li>
  <li>Create <strong>traces</strong> folder; C:\DriverTest\TestKernelDriver2\traces\</li>
  <li>Install the cerificate - <strong>TestKernelDriver2.sys</strong>; (<em>Sign mode</em>: <strong>Test Sign</strong>)</li>
  <li>Run <strong>OSR Driver Loader</strong>, choose the driver, press <strong>Register service</strong> (<em>Success</em>).</li>
  <li><p>Run <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/tracelog" rel="noreferrer">tracelog</a> with params (GUID was generated by templates; no via <strong>Tools->Create GUID</strong>) - <em>success</em>:</p>
  
  <p><code>tracelog -start TestKernelDriver2 -guid #0f4fbb98-1569-495b-88d1-f654b1e2d68e -f C:\DriverTest\TestKernelDriver2\traces\trace.etl -flag 2 -level 0xFFFF</code></p></li>
  <li><p>Check C:\DriverTest\TestKernelDriver2\traces\trace.etl; (exist - <strong>64KB</strong> size)</p></li>
  <li>OSR Driver Loader: press <strong>Start Service</strong> (<em>fail</em>). Error message: <strong>The specified procedure could not be found.</strong></li>
  <li><p>Stop <strong>tracelog</strong> - <em>success</em>:</p>
  
  <p><code>tracelog -stop TestKernelDriver2</code></p></li>
  <li><p>Open <a href="https://www.howtogeek.com/123646/htg-explains-what-the-windows-event-viewer-is-and-how-you-can-use-it/" rel="noreferrer">Event Viewer</a>. <strong>Windows logs->System</strong>. The last error:</p>
  
  <p><code>The TestKernelDriver2 service failed to start due to the following error: 
  The specified procedure could not be found.</code></p>
  
  <p><code>Details:
       EventData 
       param1 TestKernelDriver2 
       param2 %%127 
     54006500730074004B00650072006E0065006C0044007200690076006500720032000000</code></p></li>
  <li>Open C:\DriverTest\TestKernelDriver2\traces\trace.etl via <strong>Event Viewer</strong> and don't see any logs.</li>
  </ol>
  
  <p>How can I find out what is procedure was missed?</p>
  
  <p>I tried to investigate it via <a href="http://www.dependencywalker.com/" rel="noreferrer">Dependency Walker</a> and revealed that some <strong>.sys</strong> files are missed (<strong>WppRecorder.sys</strong>, <strong>WdfLdr.sys</strong>, <strong>msrpc.sys</strong>, <strong>EXT-MS-WIN-</strong>###<strong>.DLL</strong>). These filed are located in C:\Windows\System32\drivers. I copied the files to C:\Windows\System32 and <strong>Dependency Walker</strong> calmed down. What about EXT-MS-WIN-*.DLL - I read in <a href="https://stackoverflow.com/a/40077240/4359175">this topic</a> that these files can be missed.</p>
  
  <p>Thanks to @magicandre1981. I installed my driver via <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-examples" rel="noreferrer">PnPUtil</a>. But now, I see it in the list of <strong>pnputil /enum-drivers</strong> command.</p>
  
  <p><a href="https://i.stack.imgur.com/xJwsc.png" rel="noreferrer"><img src="https://i.stack.imgur.com/xJwsc.png" alt="enter image description here"></a></p>
  
  <p>But when I run the following commands in <strong>WinDbg</strong>, I don't see my driver in the list:</p>
  
  <pre><code>!load wdfkd.dll
  !wdfkd.wdfldr
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/vqaT9.png" rel="noreferrer"><img src="https://i.stack.imgur.com/vqaT9.png" alt="enter image description here"></a></p>
  
  <p>I'm trying to make steps of Session 1 from <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/debugging-kernel-mode-driver-framework-drivers" rel="noreferrer">this Microsoft ttutoriall</a>.</p>