LiveKd v5.31 - Execute kd/windbg on a live system Sysinternals - www.sysinternals.com Copyright (C) 2000-2013 Mark Russinovich and Ken Johnson
Launching C:\program files\Debugging Tools for Windows (x86)\kd.exe:
Microsoft (R) Windows Debugger Version 6.11.0001.402 X86 Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\livekd.dmp] Kernel Complete Dump File: Full address space is available
Comment: 'LiveKD live system view' Symbol search path is: srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_gdr.061219-0316 Machine Name: Kernel base = 0x80800000 PsLoadedModuleList = 0x80883620 Debug session time: Mon Jun 16 12:01:21.984 2014 (GMT+8) System Uptime: 0 days 0:55:01.987 WARNING: Process directory table base 02D8E000 doesn't match CR3 077CD000 WARNING: Process directory table base 02D8E000 doesn't match CR3 077CD000 Loading Kernel Symbols ............................................................... ............................................ Loading User Symbols ........... Loading unloaded module list ................ kd> u *** ERROR: Module load completed but symbols could not be loaded for LiveKdD.SYS
LiveKdD+0x515d: f9e4e15d eb30 jmp LiveKdD+0x518f (f9e4e18f) f9e4e15f 8b4108 mov eax,dword ptr [ecx+8] f9e4e162 8b4028 mov eax,dword ptr [eax+28h] f9e4e165 85c0 test eax,eax f9e4e167 7424 je LiveKdD+0x518d (f9e4e18d) f9e4e169 8b4028 mov eax,dword ptr [eax+28h] f9e4e16c 85c0 test eax,eax f9e4e16e 741d je LiveKdD+0x518d (f9e4e18d) kd>
|