[Autogenerated] Now, that we have remote current debugging set up.
We can Go ahead.
And Break into the target system forcefully by pressing this break button.
And then you notice that Now the target system, is completely frozen.
We can see K D here as the prompt rather,
an LD, in the local co debugging case,
and The three here indicates the processor number,
the current process or number,
that we've broken into and That's the one that's going to apply,
to any commands, that might need a processor,
relative information.
So for example, we can look at the I R Q L of the processor.
Right now, we're using the be R Q L command you can see here,
that the R Q L of this processor, is two happens,
to be dispatch level, which is very common.
Once we break here into some thread,
which is probably going to be an idle thread.
In fact, we can go ahead.
And Look at the running threads right now.
We're using the running command, this is a command,
that can't really work in a local code debugging session
because things are changing all the time.
So it doesn't really mean anything even if it would work in some way.
So obviously we can see a bunch of processors here
in each one has a current thread, and The next one in this case,
the system.
Is fairly ID So there is no next thread, that is scheduled for execution.
And The current in many cases might be the ID idea thread itself,
and of course, we can examine,
these threats if you so desire using the normal thread command
just by looking at the actual thread right here.
That belongs to some process, in the This case,
that would be Windows defender, Windows defender,
happens, to be running at that point on this particular process or so.
We can see the R Q L of a processor.
In fact, we can go ahead.
And check,
and Look at the R Q L of a different processor without
switching to it by using just the processor,
and number here.
So I can do that and we can see that This processor,
was running, code an R Q zero.
At this RQ 0.
level here.
In the debugger its the same thing as passive level,
that I mentioned in the previous video.
So this is one way of looking at R Q L S which makes sense once we are in fact,
uh breaking into a target.
So each processor has its own R Q L.
Let's look at the ID T now going to the ID T we've seen that already.
Let's see if we can still, a breakpoint, one of these inter up service routines.
Um So we can also set up breakpoints in various locations here.
That that correspond, to exceptions, but we'll discuss exceptions.
In the Next, module for now.
We can try, to Set something up here,
maybe take this timer clock interrupt as an example.
Now, before we do that let's examine the K inter wrap here,
and You notice that the I R Q L, is supposed to be 13,
that's D X, that's 13.
In fact, it corresponds to the table.
We've seen in the previous video.
So let's see if we can set up the breakpoint into this
function by using the normal B P command.
That will be the breakpoint into these interrupt, service routine.
Now let's use the go command, to let the target,
continue execution,
and As we probably expect we hit that break point
fairly quickly because this time, error wakes up every seven So milliseconds,
usually it has that 15.6 milliseconds at the very least
as the interval used for scheduling.
So we expect that to He fairly quickly if you look at the
arc L right now we can see that indeed it,
is 13 13 we expect because now the inter up service routine,
is about to run, we can see What's going on here?
In the call stack By using the normal K command.
You can see here, that this interrupt,
service routine has been called by some functions here.
That are part of a trap handling which as we know already,
is one way of is one term, that is used to to identify interrupt,
and exception.
So there's obviously some kind of handling, that is happening here.
That eventually, is going to call the particular interrupt,
service routine in this case.
So we expect this kind of call stack to be common to most if not all interrupt,
service routines before they get called.
In fact,
that's coming from some information here coming from some network card perhaps.
But in fact,
this could be just random code running at that point in time
because remember interrupts are asynchronous,
they happen when they happen, they have nothing.
To do with the currently executing code it just could be
some ad down code that was running here,
that was accessing the network card probably for debugging purposes because
it does need to communicate with the host from the target,
but that's immaterial.
So it doesn't really matter.
In the next break point, that might be a completely different.
Thing happening here.
We can Also look at the current process by using the minus one as a
special value indicating the current process.
So you can see some kind of process running here.
That would be the search host here on that Windows 11 machine,
and Again, it could be anything really because it has nothing.
To do with the interrupt itself.
We don't see much here.
In the call stack in users space.
But if you so desire we can actually,
do that or at least try to do that by using dot re load slash user to force,
user mode symbols, to be loaded for the current process.
Then you can try the K command again.
We can see indeed.
User mode addresses appear here.
That are coming from some socket stuff here,
some networking client operations happening on these search host,
and this is something, that is running here by some thread from the thread,
pool things that We've seen in the past in previous courses.
If I go ahead and use go again.
To break point again, hit a break point for the timer.
And the next time.
That timer hits.
We expect the call stack to be potentially different
could be anything really notice.
In this case, the call stack is completely different.
It has the XML light library being used here for
reading or writing XML and there, is some stuff here related to writing,
a file a file is being written and while it has been written,
an interrupt came in for the timer.
So it has nothing.
To do again with the currently executing code which is
trying to write some information.
To some file of course, we can try to examine,
that but it doesn't really matter here.
The point here, is that We got the interrupt here coming from some location.
That has nothing.
To do with the, the actual code running this is an N T,
fs code that has been running at that point in time.
And We got that break point again.
And Of course, we expect the our two L, to be back at level 13