Is it necessary to set a breakpoint in kernel-mode driver to debug a function in its user-mode counter-part (using Windbg)?

Question

I'm using Windbg for debugging my user-mode driver (consider USB). My driver-package (debug build, 64 bit) has both kernel-mode and user-mode code.The package was successfully installed in my target machine and the module too got loaded (as I can verify using the windbg-command: 'lm'). And I'm running the Windbg in Admin mode on the host and debugging the target using 1394 firewire card.

After commencing the application, when I try to debug a function in the user-mode driver, I observe that the intended-function is not getting hit though the break-point is properly set and enabled. Then I set a break-point of a function (a recurring service procedure which often gets hit when enabled) in kernel-code. This time this kernel mode driver function breaks-in and after sometime the above-set user-mode driver function too breaks-in and I can debug the same and follow the code path.

Again, when I close & restart the application, only when the kernel mode driver-function break-point is enabled and hit, the user mode driver-function gets hit. But, if its disabled, the user mode driver function is not hit. This happens irrespective of on what functions we are setting the break-points on kernel-mode or user-mode drivers.

Why this behavior, though the modules are properly loaded? Do I need to configure or make sure something so that as and when I start the application, I dont need to rely on the kernel-mode part?

Answer 1

i have seen WinDBG behave a little weird at times when it comes to debugging user mode calls!

One quick suggestion would be : If you are debugging on Vista or above note that there are multiple sessions running. For example,

Each user logged on as has a different session]
The services run in session '0'

It is possible that you not setting the break-point in the right session.

Answer 2

See my article here for information about why you're getting this behavior:

http://www.osronline.com/article.cfm?id=576

You're generally better off debugging your user mode code on the target machine, doing it over the debug connection isn't always friendly.