WinDbging ntkrnlpa

[Swa]

I'm looking to set a breakpoint on the start of a new process. Specifically ntkrnlpa.exe. I can track where the file is loaded but it doesn't seem to map the same to memory (didn't expect it to) and wouldn't know how to find the program entry point in any case. So far only managed to crash the VM. WinDbg also lists the process as ntkrpamp while the process list sees it simply as nt. Exactly what name and command should I use?

 

[Glingfram]

You'd be better off using Stack Overflow for a question so specific. I doubt many of the prgrammers on here will have that answer for you.

 

[semaphore]

Last time i did memory debugging was with softICE :/

 

[cguy]

What are you trying to achieve? That process is the kernel - it always starts before windbg.

 

[kripstoe]

Last time i did memory debugging was with softICE :/

+1!

 

[Swa]

Thanks for the replies. Might have found a way to achieve what I want with function breakpoints though so will see.