In Sysinternals' livekd, how can we find the information associated with a process from its PID?

Question

I want to get information on a process from Sysinternals' livekd using its process ID. How do I do this?

The documentation for WinDBG's !process command on MSDN (https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/-process) says,

!process [/s Session] [/m Module] [Process [Flags]]

gives information about the process specified by "Process". The documentation further says,

Process - Specifies the hexadecimal address or the process ID of the process on the target computer.

But try as I might, specifying the PID gives nothing, and I can't see a way to find the hexadecimal address of the process structure for a running process.

For e.g., from Sysinternals' Process Explorer, I see a process with PID 672 backed by svchost.exe, as follows:

But when I use the !process command with the PID 672 or its hexadecimal, 2A0, I get nothing. See below:

0: kd> !process 672
Searching for Process with Cid == 672
Cannot resolve nt!_EPROCESS object type
0: kd> !process 2A0
Searching for Process with Cid == 2a0
Cannot resolve nt!_EPROCESS object type

But !process svchost.exe works (for a some instance of that image that's running):

0: kd> !process svchost.exe
PROCESS ffffdc0a4b49b180
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 001ad002  ObjectTable: ffff9a0ba4e3ee40  HandleCount: 6664.
    Image: System
    VadRoot ffffdc0a66ea3200 Vads 58 Clone 0 Private 30. Modified 31341619. Locked 192.
    DeviceMap ffff9a0ba4e36360
    Token                             ffff9a0ba4e072b0
    ElapsedTime                       5 Days 13:59:48.702

I can also use !process ffffdc0a4b49b180 using the information gained from !process svchost.exe, but I want to use the process ID to get this information. How do I do this?

Edit 1: I think that I am setting the symbols correctly, based on information here: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/symbol-path . Please see the output below.

0: kd> .sympath
Symbol search path is: srv*c:\symbols\*https://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\symbols\*https://msdl.microsoft.com/download/symbols

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\symbols\*https://msdl.microsoft.com/download/symbols
0: kd> lml
start             end                 module name
fffff804`82200000 fffff804`83246000   nt         (pdb symbols)          c:\symbols
tkrnlmp.pdb\1F9BB45B28B806E4D18925C06E924B8C1
tkrnlmp.pdb
fffff804`a3420000 fffff804`a342d000   LiveKdD    (no symbols)           
0: kd> !sym noisy
noisy mode - symbol prompts on
0: kd> .reload nt
SYMSRV:  BYINDEX: 0xF
         c:\symbols\*https://msdl.microsoft.com/download/symbols
         ntoskrnl.exe
         F05723421046000
SYMSRV:  PATH: c:\symbols
toskrnl.exe\F05723421046000
toskrnl.exe
SYMSRV:  RESULT: 0x00000000
DBGHELP: c:\symbols
toskrnl.exe\F05723421046000
toskrnl.exe - OK
DBGENG:  c:\symbols
toskrnl.exe\F05723421046000
toskrnl.exe - Mapped image memory
SYMSRV:  BYINDEX: 0x10
         c:\symbols\*https://msdl.microsoft.com/download/symbols
         ntkrnlmp.pdb
         1F9BB45B28B806E4D18925C06E924B8C1
SYMSRV:  PATH: c:\symbols
tkrnlmp.pdb\1F9BB45B28B806E4D18925C06E924B8C1
tkrnlmp.pdb
SYMSRV:  RESULT: 0x00000000
DBGHELP: nt - public symbols  
        c:\symbols
tkrnlmp.pdb\1F9BB45B28B806E4D18925C06E924B8C1
tkrnlmp.pdb
0: kd> dt nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x438 ProcessLock      : _EX_PUSH_LOCK
   +0x440 UniqueProcessId  : Ptr64 Void
   +0x448 ActiveProcessLinks : _LIST_ENTRY
   +0x458 RundownProtect   : _EX_RUNDOWN_REF
   +0x460 Flags2           : Uint4B
   +0x460 JobNotReallyActive : Pos 0, 1 Bit
   +0x460 AccountingFolded : Pos 1, 1 Bit
   +0x460 NewProcessReported : Pos 2, 1 Bit
   ....

Edit 2:

I just discovered that LiveKdD.sys is not getting loaded. I have reinstalled Windows SDK, and uninstalled my antivirus software. That doesn't fix this issue.

But, LivekdD.sys is present in the directory it's trying to load it from. See below.

PS C:\WINDOWS\system32\drivers> dir livekdd.sys


    Directory: C:\WINDOWS\system32\drivers


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        24-11-2021     21:53          39272 livekdd.sys


Launching D:\Windows Kits\10\Debuggers\x64\kd.exe:

Microsoft (R) Windows Debugger Version 10.0.22000.194 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\livekd.dmp]
Kernel Complete Dump File: Full address space is available

Comment: 'LiveKD live system view'

************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff807`75400000 PsLoadedModuleList = 0xfffff807`7602a2d0
Debug session time: Wed Nov 24 22:03:56.831 2021 (UTC + 5:30)
System Uptime: 0 days 0:13:04.851
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..................................
Loading User Symbols
..........................................
Loading unloaded module list
............
For analysis of this file, run !analyze -v
0: kd> .tlist notepad.exe
Unable to load image \??\C:\WINDOWS\system32\Drivers\LiveKdD.SYS, Win32 error 0n2
 0n3176 notepad.exe

In Sysinternals' livekd, how can we find the information associated with a process from its PID?

Answers (1)

Related Questions

In Sysinternals&#39; livekd, how can we find the information associated with a process from its PID?

Answers (1)

Related Questions

In Sysinternals' livekd, how can we find the information associated with a process from its PID?