NtSystemDebugControl函数在WIN7 RC下支持以下功能:
(如果KdPitchDebugger为TRUE,即在bcd中指定了nodebug,则只支持29号功能)
需要校验DEBUG权限
其中29号功能也是比较有意思的,可以产生一个系统即时的MINIDUMP
6:if KdDebugEnable , return STATUS_UNSUCESSFUL else DbgBreakWithStatus(6)
22: KdDisableDebugger
21:KdEnableDebugger
23:get status of KdAutoEnableOnEvent(input len = 1)
24:set KdAutoEnableOnEvent (input len =1)
25:get KdPrintBufferSize (input len =4)
26:set KdPrintBufferSize(input len =4)
27:get KdIgnoreUmExceptions(input len =1)
28:set KdIgnoreUmExceptions(input len =1)
29:DbgkCaptureLiveDump
30:get KdBlockEnable
31:set KdBlockEnable
32:set KdUmBreakMarker , 0xDB1DBBBB
33.get KdUmBreakPid
34:set KdUmBreakPid
35:get KdUmAttachPid
36:set KdUmAttachPid