Debugging Secured Windows OS guest using KVM/QEMU and Windbg
summary
Demonstrates kernel debugging of a secured Windows guest on KVM/QEMU using WinDbg by implementing an XDI-to-GDB bridge so WinDbg talks to QEMU instead of an enabled debugger inside the guest. Uses Intel DCI hardware experiments but replaces bare metal wiring with the XDI GDB server sample adapted to QEMU gdbstub. Works for 32-bit then 64-bit guests and can reach secure kernel state, but implementation is unstable, incomplete, crashes on long breakpoints, and lacks many full WinDbg features.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:19Agenda
- 1:04Problem definition
- 5:36Investigation phase
- 6:32Research
- 7:39DCI
- 10:17Stability
- 11:57Windbg
- 13:10XDI Architecture
- 16:18Windows 64
- 16:44Running Windbg
- 17:43Screenshot
- 18:48Limitations
- 19:39Outro
related talks
50mProtected KVM on Arm64: A Technical Deep Dive
40mDebugging in Golang Apps Inside K8s Environment
20mKVM-devirt: Extending KVM to a Zero-Overhead Partition Hypervisor
11mBuild your own virtual machine with /dev/kvm and Rust!
10mDemo: Nested Virtualization Acceleration
07mLightning Talk: Confidential VMs in Kubevirt: Securing VMs With Kube...
32mNotes on Taking KVM-on-KVM Nested Virtualization for a Spin
35mThe Art of Debugging Inside K8s Environment