Neura Market
vitoplantamura/BugChecker logo

vitoplantamura/BugChecker

Free

SoftICE-like kernel debugger for Windows 11

FreeFree tier
Outputs: text
Type
Open Source
Visit Website GitHub (38 stars)

About vitoplantamura/BugChecker

BugChecker is a SoftICE-like kernel and user debugger for Windows 11 (and Windows XP as well, supporting versions from XP to 11, both x86 and x64). Unlike traditional kernel debuggers, it does not require a second machine; instead, it leverages the internal and undocumented KD API in NTOSKRNL to present itself as a second system running an external kernel debugger on the same machine. This is achieved by intercepting calls to KdSendPacket and KdReceivePacket, typically by replacing KDCOM.DLL and starting the system in kernel debugging mode. This approach (inspired by VirtualKD) lowers complexity, increases stability and compatibility, and disables PatchGuard by appearing as a debugger at boot time. BugChecker features JavaScript integration via QuickJSPP, allowing commands to accept JS expressions, custom functions in a Script Window, and breakpoints with JS conditions for logpoints and flow control. It supports PDB symbol files, WOW64 processes, and SMP kernels. Currently, it requires a PS/2 keyboard for input and a linear framebuffer for output.

Key Features

Supports Windows XP through 11, x86 and x64, including SMP kernels
Single-machine debugging no second computer needed
Leverages internal KD API for stability and compatibility
Disables PatchGuard by presenting a fake kernel debugger at boot
JavaScript integration with QuickJSPP for command expressions and scripting
Breakpoints with JavaScript conditions for logpoints and flow control
Support for PDB symbol files with manual or automatic Symbol Loader
Supports WOW64 processes on x64 systems

Pros & Cons

Pros
  • No need for a second machine, reducing hardware requirements
  • High compatibility across Windows versions and architectures
  • JavaScript scripting enables flexible breakpoints and automation
  • Open source and freely available on GitHub
  • Uses stable KD API instead of hooking kernel functions
  • Avoids PatchGuard by faking debugger presence at boot
Cons
  • Currently requires a PS/2 keyboard, not compatible with USB keyboards
  • Requires a linear framebuffer display for output, no GUI
  • May have limited hardware compatibility due to specific requirements

Best For

Kernel debugging for Windows drivers and system internalsUser-mode debugging of complex applicationsReverse engineering and malware analysis on WindowsTeaching and learning Windows debugging techniquesDeveloping and testing low-level system components

FAQ

Does BugChecker require a second machine?
No, BugChecker operates on a single machine by intercepting KD API calls, eliminating the need for a separate debugging system.
What Windows versions are supported?
BugChecker supports Windows XP through Windows 11, both x86 and x64 architectures, including SMP kernels.
Can BugChecker be used with USB keyboards?
Currently, BugChecker requires a PS/2 keyboard for input. Note that many modern laptops still use PS/2 for their built-in keyboards.
How does BugChecker avoid PatchGuard?
By presenting a kernel debugger to Windows at boot time, PatchGuard is disabled, allowing BugChecker to operate without interference.
Does BugChecker support JavaScript for breakpoints?
Yes, breakpoints can have JavaScript conditions. If the condition evaluates to 0, no break occurs, enabling logpoints and flow-changing breakpoints.