Moreover, 20 years later, PatchGuard makes this solution impossible.īy contrast, this version of BugChecker, by intercepting calls to KdSendPacket and KdReceivePacket in the kernel, presents itself to the machine being debugged as a second system running an external kernel debugger, but, in reality, everything happens on the same machine. This approach increases complexity exponentially (and lowers system stability), since the implementation must be compatible with all the supported versions and sub-version of Windows (at the function signature level) as well as all the possible supported hardware configurations. KD API allows WinDbg/KD to do calls like read/write virtual memory, read/write registers, place a breakpoint at an address etc.īy contrast, the original BugChecker, like SoftICE as well, used to 'take over' the system, by hooking several kernel APIs (both exported and private), taking control of the APIC, sending IPIs etc. This version of BugChecker (unlike the original version developed 20 years ago) leverages the internal and undocumented KD API in NTOSKRNL.

BugChecker doesn't require a second machine to be connected to the system being debugged, like in the case of WinDbg and KD.

BugChecker is a SoftICE-like kernel and user debugger for Windows 11 (and Windows XP as well: it supports Windows versions from XP to 11, both x86 and 圆4).

Win11 checker