setupldr!BdInitDebugger函数分析之BD: Boot Debugger Initialized—-非常重要
通过网盘分享的文件：123.7z
链接: https://pan.baidu.com/s/1GHQEXbcqAzcyT7IFkKJtIg?pwd=3790 提取码: 3790
–来自百度网盘超级会员v8的分享
第一部分：
D:\\srv03rtm\\base\\boot\\setup\\daytona_dbg\\obj\\i386>copy setupldr_dbg.bin e:\\srv\\I386\\SETUPLDR.bin
覆盖 e:\\srv\\I386\\SETUPLDR.bin 吗? (Yes/No/All): y
已复制 1 个文件。
D:\\srv03rtm\\base\\boot\\setup\\daytona_dbg\\obj\\i386>copy setupldr_dbg.exe e:\\srv\\I386\\SETUPLDR.exe
已复制 1 个文件。
D:\\srv03rtm\\base\\boot\\setup\\daytona_dbg\\obj\\i386>
E:\\>cd srv
E:\\srv>cd I386
E:\\srv\\I386>EXPAND.EXE MAKECAB.EX_ makecab.exe
Microsoft (R) File Expansion Utility Version 5.2.3790.0
Copyright (c) Microsoft Corporation. All rights reserved.
Expanding makecab.ex_ to makecab.exe.
makecab.ex_: 41514 bytes expanded to 81408 bytes, 96% increase.
E:\\srv\\I386>makecab.exe SETUPLDR.EXE
Microsoft (R) Cabinet Maker – Version 5.2.3790.0
Copyright (c) Microsoft Corporation. All rights reserved..
100.00% [flushing current folder]
E:\\srv\\I386>cd ..
E:\\srv>cd ..
E:\\>cd 123
E:\\123>oscdimg.exe -m -n -be:\\123\\etfsboot.com e:\\srv srv.iso
OSCDIMG 2.45 CD-ROM and DVD-ROM Premastering Utility
Copyright (C) Microsoft, 1993-2000. All rights reserved.
For Microsoft internal use only.
Scanning source tree complete (8080 files in 58 directories)
Computing directory information complete
Image file is 607731712 bytes
Writing 8080 files in 58 directories to srv.iso
100% complete
Final image file is 607731712 bytes
Done.
E:\\123>
第二部分：
************* Path validation summary **************
Response Time (ms) Location
OK D:\\user\\cheng\\retail
Waiting to reconnect…
BD: Boot Debugger Initialized
BD: setupldr.exe base address 00300000
Connected to Windows Boot Debugger 3790 x86 compatible target at (Wed Feb 11 15:59:49.530 2026 (UTC + 8:00)), ptr64 FALSE
Kernel Debugger connection established.
************* Path validation summary **************
Response Time (ms) Location
OK D:\\user\\cheng\\retail
Symbol search path is: D:\\user\\cheng\\retail
Executable search path is:
Module List address is NULL – debugger not initialized properly.
WARNING: .reload failed, module list may be incomplete
KdDebuggerData.KernBase < SystemRangeStart
ReadVirtual() failed in GetXStateConfiguration() first read attempt (error == 997.)
Windows Boot Debugger Kernel Version 3790 UP Checked x86 compatible
Machine Name:
Primary image base = 0x00000000 Loaded module list = 0x00000000
System Uptime: not available
BD: \\I386\\ntkrnlmp.exe base address 809F2000
Break instruction exception – code 80000003 (first chance)
*** WARNING: Unable to verify timestamp for setupldr.exe
setupldr!RtlpBreakWithStatusInstruction:
0031f390 cc int 3
kd> kc
#
00 setupldr!RtlpBreakWithStatusInstruction
01 setupldr!vDbgPrintExWithPrefix
02 setupldr!DbgPrint
03 setupldr!BlLoadImage32Ex
04 setupldr!SlInit
05 setupldr!BlStartup
06 setupldr!NtProcessStartup
WARNING: Frame IP not in any known module. Following frames may be wrong.
kd> bl
0 e Disable Clear 00315f78 [d:\\srv03rtm\\base\\boot\\lib\\peldrt.c @ 89] 0001 (0001) setupldr!BlLoadImage32Ex
1 e Disable Clear 00324b92 [d:\\srv03rtm\\base\\boot\\setup\\setup.c @ 4642] 0001 (0001) setupldr!SlLoadDriver
2 e Disable Clear 0032459e [d:\\srv03rtm\\base\\boot\\setup\\setup.c @ 4865] 0001 (0001) setupldr!SlGetDisk
3 e Disable Clear 00317dbb [d:\\srv03rtm\\base\\boot\\lib\\blload.c @ 905] 0001 (0001) setupldr!BlLoadDeviceDriver
kd> kv 5
# ChildEBP RetAddr Args to Child
00 000603cc 0031f079 00000001 203a4442 3833495c setupldr!RtlpBreakWithStatusInstruction (FPO: [1,0,0]) [d:\\srv03rtm\\base\\ntos\\rtl\\i386\\debug2.asm @ 59]
01 000605e0 0031f10a 0033c11c ffffffff 00000000 setupldr!vDbgPrintExWithPrefix+0x8b (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\ntos\\rtl\\debug.c @ 325]
02 000605fc 003163b7 0033d254 00348198 809f2000 setupldr!DbgPrint+0x18 (FPO: [Non-Fpo]) (CONV: cdecl) [d:\\srv03rtm\\base\\ntos\\rtl\\debug.c @ 71]
03 00060b9c 00327dfb 00000000 809f2268 00348198 setupldr!BlLoadImage32Ex+0x43f (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\lib\\peldrt.c @ 572]
04 00060df4 00322a21 01060e2c 0000000b 00000000 setupldr!SlInit+0x1db5 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\setup\\setup.c @ 2511]
kd> bp 003163b7
ARC_STATUS
BlLoadImageEx(
IN ULONG DeviceId,
IN TYPE_OF_MEMORY MemoryType,
IN PCHAR LoadFile,
IN USHORT ImageType,
IN OPTIONAL ULONG PreferredAlignment,
IN OPTIONAL ULONG PreferredBasePage,
OUT PVOID *ImageBase
)
{
if(BdDebuggerEnabled) {
DbgPrint("BD: %s base address %p\\n", LoadFile, *ImageBase);返回到这里
kd> g
Breakpoint 4 hit
setupldr!BlLoadImage32Ex+0x43f:
003163b7 83c40c add esp,0Ch
kd> dv
DeviceId = 0
MemoryType = 0n-2137054616 (No matching enumerant)
LoadFile = 0x00348198 "\\I386\\ntkrnlmp.exe"
kd> kc 3
#
00 setupldr!SlInit
01 setupldr!BlStartup
02 setupldr!NtProcessStartup
kd> kv 3
# ChildEBP RetAddr Args to Child
00 00060df4 00322a21 01060e2c 0000000b 00000000 setupldr!SlInit+0x1db5 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\setup\\setup.c @ 2511]
01 00060ed0 003015aa 00379400 0038164f 00061d68 setupldr!BlStartup+0x1bd (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\setup\\i386\\initx86.c @ 208]
02 00061ff0 10101010 00000002 00010001 00010001 setupldr!NtProcessStartup+0x208 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\lib\\i386\\entry.c @ 348]
BlOutputLoadMessage(BootDevice, KernelDirectoryPath, BlFindMessage(SL_KERNEL_NAME));
Status = BlLoadImage(BootDeviceId,
LoaderSystemCode,
KernelDirectoryPath,
TARGET_IMAGE,
&SystemBase);
//
// If the kernel didn't fit in the preferred range, reset the range to
// all of memory and try again.
//
#ifdef i386
if ((Status == ENOMEM) &&
((BlUsableBase != 0) ||
(BlUsableLimit != _16MB))) {
BlUsableBase = 0;
BlUsableLimit = _16MB;
goto retrykernel;
}
#endif
if (Status != ESUCCESS) {
SlFatalError(SL_FILE_LOAD_FAILED,
SlCopyStringAT(KernelDirectoryPath),
Status);
goto LoadFailed;
}
BlUpdateBootStatus();
//
// Load the HAL.
//
strcpy(HalDirectoryPath, BootPath);
if (PromptOemHal || (PreInstall && (ComputerType != NULL))) {
。。。
} else {
//
// Note that on x86, the HAL may be on floppy #1 or floppy #2
//
strcat(HalDirectoryPath,HalName);
SlGetDisk(HalName);
BlOutputLoadMessage(BootDevice, HalDirectoryPath, BlFindMessage(SL_HAL_NAME));
kd> t
Breakpoint 2 hit
setupldr!SlGetDisk:
0032459e 55 push ebp
kd> kc 4
#
00 setupldr!SlGetDisk
01 setupldr!SlInit
02 setupldr!BlStartup
03 setupldr!NtProcessStartup
kd> dv
Filename = 0x8023eedd "halaacpi.dll"
FileId = 8
DiskName = 0x8023eedd "halaacpi.dll"
PlatformSpecificSection = char [128] "SourceDisksN???"
第三部分：第二次测试。
通过网盘分享的文件：SETUPLDR调试版
链接: https://pan.baidu.com/s/10_ZtHAMqHtnrYF5KP8PACw?pwd=3790 提取码: 3790
–来自百度网盘超级会员v8的分享
Microsoft (R) Windows Debugger Version 10.0.19041.5609 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Waiting for pipe \\\\.\\pipe\\com_1
Waiting to reconnect…
BD: Boot Debugger Initialized
BD: setupldr.exe base address 00300000
Connected to Windows Boot Debugger 3790 x86 compatible target at (Wed Feb 11 22:03:44.648 2026 (UTC + 8:00)), ptr64 FALSE
Kernel Debugger connection established.
************* Path validation summary **************
Response Time (ms) Location
OK D:\\user\\cheng\\retail
Symbol search path is: D:\\user\\cheng\\retail
Executable search path is:
Module List address is NULL – debugger not initialized properly.
WARNING: .reload failed, module list may be incomplete
KdDebuggerData.KernBase < SystemRangeStart
ReadVirtual() failed in GetXStateConfiguration() first read attempt (error == 997.)
Windows Boot Debugger Kernel Version 3790 UP Checked x86 compatible
Machine Name:
Primary image base = 0x00000000 Loaded module list = 0x00000000
System Uptime: not available
Break instruction exception – code 80000003 (first chance)
*** WARNING: Unable to verify timestamp for setupldr.exe
setupldr!DbgBreakPoint:
0031f384 cc int 3
kd> kc
#
00 setupldr!DbgBreakPoint
01 setupldr!BdInitDebugger
02 setupldr!MempCopyGdt
03 setupldr!InitializeMemorySubsystem
04 setupldr!DoGlobalInitialization
05 setupldr!NtProcessStartup
WARNING: Frame IP not in any known module. Following frames may be wrong.
06 0x0
07 0x0
08 0x0
09 0x0
0a 0x0
0b 0x0
0c 0x0
0d 0x0
0e 0x0
0f 0x0
10 0x0
11 0x0
12 0x0
13 0x0
14 0x0
kd> bl
0 e Disable Clear 00315f78 [d:\\srv03rtm\\base\\boot\\lib\\peldrt.c @ 89] 0001 (0001) setupldr!BlLoadImage32Ex
1 e Disable Clear 00324b92 [d:\\srv03rtm\\base\\boot\\setup\\setup.c @ 4642] 0001 (0001) setupldr!SlLoadDriver
2 e Disable Clear 0032459e [d:\\srv03rtm\\base\\boot\\setup\\setup.c @ 4865] 0001 (0001) setupldr!SlGetDisk
3 e Disable Clear 00317dbb [d:\\srv03rtm\\base\\boot\\lib\\blload.c @ 905] 0001 (0001) setupldr!BlLoadDeviceDriver
kd> kv
# ChildEBP RetAddr Args to Child
00 00060e68 0031c09c 0003f000 00336bc0 00024538 setupldr!DbgBreakPoint (FPO: [0,0,0]) [d:\\srv03rtm\\base\\ntos\\rtl\\i386\\debug2.asm @ 42]
01 00060e88 00302b0f 003435b4 00300000 003396b4 setupldr!BdInitDebugger+0x185 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\bd\\init.c @ 173]
02 00060ea0 00302fc0 0038164f 00024538 003013a2 setupldr!MempCopyGdt+0x16a (FPO: [0,0,0]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\lib\\i386\\memory.c @ 854]
03 00060ec0 0030128a 00024538 00024538 00061ff0 setupldr!InitializeMemorySubsystem+0x215 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\lib\\i386\\memory.c @ 534]
04 00060ed0 003013ba 00024538 0038164f 00061d68 setupldr!DoGlobalInitialization+0x1d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\lib\\i386\\entry.c @ 662]
05 00061ff0 10101010 00024538 00810081 00810081 setupldr!NtProcessStartup+0x18 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\\srv03rtm\\base\\boot\\lib\\i386\\entry.c @ 137]
WARNING: Frame IP not in any known module. Following frames may be wrong.
06 00061ff8 00810081 00810081 00010081 00010001 0x10101010
07 00061ffc 00810081 00010081 00010001 00010001 0x810081
08 00062000 00010081 00010001 00010001 00010001 0x810081
09 00062004 00010001 00010001 00010001 00010001 0x10081
0a 00062008 00010001 00010001 00010001 00010001 0x10001
0b 0006200c 00010001 00010001 00010001 00010001 0x10001
0c 00062010 00010001 00010001 00010001 00010001 0x10001
0d 00062014 00010001 00010001 00010001 00010001 0x10001
0e 00062018 00010001 00010001 00010001 00010001 0x10001
0f 0006201c 00010001 00010001 00010001 00100001 0x10001
10 00062020 00010001 00010001 00100001 00100010 0x10001
11 00062024 00010001 00100001 00100010 00100010 0x10001
12 00062028 00100001 00100010 00100010 00820010 0x10001
13 0006202c 00100010 00100010 00820010 00820082 0x100001
14 00100001 00000000 00000000 00000000 00000000 0x100010
kd> bp 0031c09c
VOID
BdInitDebugger (
IN PCHAR LoaderName,
IN PVOID LoaderBase,
IN PCHAR Options
)
{
//
// Announce debugger initialized.
//
DbgPrint("BD: Boot Debugger Initialized\\n");
//
// Notify the kernel debugger to load symbols for the loader.
//
String.Buffer = LoaderName;
String.Length = (USHORT) strlen(LoaderName);
DbgPrint("BD: %s base address %p\\n", LoaderName, LoaderBase);
DbgLoadImageSymbols(&String, LoaderBase, (ULONG_PTR)-1);
if (strstr(Options, "DEBUGSTOP") != NULL) {
//
// Treat this like a request for initial breakpoint.
//
DbgBreakPoint();
}
