在内核态下巧设用户模块断点

假如我们调试内核时，需要在kernel32中设断点。一般情况下，使用调试器中断到内核中时，当时进程和线程都是Idle，

kd> !process
PROCESS 8054a900  SessionId: none  Cid: 0000    Peb: 00000000  ParentCid: 0000
    DirBase: 00039000  ObjectTable: e1000d68  HandleCount: 128.
    Image: Idle
    VadRoot 00000000 Vads 0 Clone 0 Private 0. Modified 0. Locked 0.
    DeviceMap 00000000
    Token                             e1000820
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        01:44:44.025
    QuotaPoolUsage[PagedPool]         0
    QuotaPoolUsage[NonPagedPool]      0
    Working Set Sizes (now,min,max)  (5, 50, 450) (20KB, 200KB, 1800KB)
    PeakWorkingSetSize                5
    VirtualSize                       0 Mb
    PeakVirtualSize                   0 Mb
    PageFaultCount                    1
    MemoryPriority                    BACKGROUND
    BasePriority                      0
    CommitCharge                      0

        THREAD 8054a6a0  Cid 0000.0000  Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0

kd> !thread
THREAD 8054a6a0  Cid 0000.0000  Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
Owning Process            0       Image:        
Attached Process          8054a900       Image:         Idle
Wait Start TickCount      647712         Ticks: 71 (0:00:00:00.711)
Context Switch Count      108363            
UserTime                  00:00:00.000
KernelTime                01:44:44.025
Stack Init 80542200 Current 80541f4c Base 80542200 Limit 8053f200 Call 0
Priority 16 BasePriority 0 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr  Args to Child             
80541ebc 805120f8 00000001 00000202 00000030 nt!RtlpBreakWithStatusInstruction (FPO: [1,0,0])
80541ebc 806ccefa 00000001 00000202 00000030 nt!KeUpdateSystemTime+0x142 (FPO: [0,2] TrapFrame @ 80541ed0)
WARNING: Frame IP not in any known module. Following frames may be wrong.
80541f40 804eed89 8054a6a0 ffdffc50 ffdff980 0x806ccefa
80541f50 804f1d65 00000000 0000000e 00000000 nt!PopIdle0+0x47 (FPO: [Non-Fpo])
80541f54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x10 (FPO: [0,0,0])

直接设断点会提示错误，因为kernel32模块此时并没有加载

kd> bp kernel32!TerminateProcess
Bp expression 'kernel32!TerminateProcess' could not be resolved, adding deferred bp

断点状态是unresolve

 

全文见在内核态下巧设用户模块断点