Search code examples
debuggingwindbgremote-debugging

__debugbreak() without connecting windbg


__debugbreak() statement in a KMD results in a BSOD, if WinDbg is not connect. I want to understand why?

I'm thinking the DUT and debugger exchange some artifacts..?


Solution

  • The __debugbreak intrinsic raises a breakpoint exception. (int 3 on x86 systems)

    Without a debugger, this goes unhandled, which will result in a bugcheck.

    If you'd like to detect the presence of a kernel debugger, the KD_DEBUGGER_NOT_PRESENT variable might be of use to you.

    KD_DEBUGGER_NOT_PRESENT isn't always up to date, but it can be refreshed using KdRefreshDebuggerNotPresent().

    You might need something like this:

    void BreakIfDebuggerPresent()
    {
        if (!KdRefreshDebuggerNotPresent()) {
            DbgBreakPoint();
        }
    }