|
| 1 | +# Setup Windbg KDNET |
| 2 | + |
| 3 | +## Preparation |
| 4 | + - A device with windows installed as debugging slave. |
| 5 | + - UEFI Image |
| 6 | + - An windows device with [windbg preview](https://apps.microsoft.com/detail/9pgjgd53tn86) installed as debugging host. |
| 7 | + - USB Cable |
| 8 | + |
| 9 | +## Setup BCD |
| 10 | + - Mount ESP Partition on you phone with root permission in adb shell or termux. |
| 11 | + + Simply jump this step if you are using USB mass storage mode. |
| 12 | + ```bash |
| 13 | + # Execute on phone |
| 14 | + mkdir /dev/esp_mnt |
| 15 | + mount /dev/block/by-name/esp /dev/esp_mnt |
| 16 | + ``` |
| 17 | + - Copy BCD to your host computer. |
| 18 | + + If you are using UMS, find the BCD file and copy it to D: or anywhere you want in explorer. |
| 19 | + + Copy to /sdcard |
| 20 | + ```bash |
| 21 | + # Execute on phone |
| 22 | + cp /dev/esp_mnt/EFI/Microsoft/Boot/BCD /sdcard |
| 23 | + ``` |
| 24 | + + Pull to computer. |
| 25 | + ```powershell |
| 26 | + # Execute on computer, assuming installed adb. |
| 27 | + # Assuming copy to D:, you can set any path you want. |
| 28 | + adb pull /sdcard/BCD D:\ |
| 29 | + ``` |
| 30 | + - Open an **administrator** terminal and set bcd configurations. |
| 31 | + ```powershell |
| 32 | + cd D:\ |
| 33 | + bcdedit /store BCD /set "{default}" testsigning on |
| 34 | + bcdedit /store BCD /set "{default}" nointegritychecks on |
| 35 | + bcdedit /store BCD /set "{default}" debug on |
| 36 | + bcdedit /store BCD /dbgsettings net hostip:169.254.255.255 port:50000 key:1.1.1.1 |
| 37 | + ``` |
| 38 | + - Push BCD back to your phone. |
| 39 | + + If you are using UMS, simply replace the original BCD file. |
| 40 | + ```powershell |
| 41 | + # Execute on computer |
| 42 | + adb push BCD /sdcard |
| 43 | + # Delete BCD after pushing |
| 44 | + del D:\BCD |
| 45 | + ``` |
| 46 | + ```bash |
| 47 | + # Execute on phone |
| 48 | + # Backup nomal BCD |
| 49 | + cp /dev/esp_mnt/EFI/Microsoft/Boot/BCD /dev/esp_mnt/EFI/Microsoft/Boot/NMBCD |
| 50 | + # Backup kdnet enabled BCD |
| 51 | + cp /sdcard/BCD /dev/esp_mnt/EFI/Microsoft/Boot/DBGBCD |
| 52 | + # Replace active BCD |
| 53 | + cp /sdcard/BCD /dev/esp_mnt/EFI/Microsoft/Boot/BCD |
| 54 | + ``` |
| 55 | + |
| 56 | +### Setup KDNET in Windbg |
| 57 | + - Opne Windbg(Preview),Click the **File** button on the top left corner |
| 58 | + - Click `Attach to kernel`(default section) under `Start Debugging`. |
| 59 | + - Click `Net`(default section) |
| 60 | + + Type `50000` in `Port Number` |
| 61 | + + Type `1.1.1.1` in `Key` |
| 62 | +  |
| 63 | + - Click `OK` button on the bottom |
| 64 | +  |
| 65 | + |
| 66 | +### Connect slave device |
| 67 | + - Reboot your phone, and connect it to computer with a usb cable. |
| 68 | + ```powershell |
| 69 | + # Execute on computer, boot uefi |
| 70 | + fastboot boot uefi.img |
| 71 | + ``` |
| 72 | + - If all configurations were done correctly, your phone will hang up at windows logo without a loading circle. |
| 73 | + - Open a device manager or task manager, you can find a network card named KdNET EEM. |
| 74 | + - Ensure your windbg is opened, after several minutes it will print logs after successfully connected to phone server. |
| 75 | + - Windows on phone will load once windbg connected. |
| 76 | + - You can press `Ctrl+Alt+V` to enable verbose mode for checking driver loading status. |
| 77 | + - End |
| 78 | + |
0 commit comments