title: How does WinDbg itself work?
body: <p>I have recently started windows driver development. I am wondering how does it actually debug my driver. The setup I have is --> Win7 as host, XP as guest on VMware, and I am debugging through serial port.</p>
  
  <p>The research I have done: </p>
  
  <p>I found only <a href="http://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/f4f7e0e0-dff0-42d3-905b-b3aafd88296c/how-does-windbg-break-in-to-the-kernel-of-target-machine?forum=wdk" rel="nofollow">this</a> link saying very few things that I am talking about.</p>
  
  <p>I already know how debugger works on single OS, in that case debugger is also on the same OS, so it knows which process is running. That is understandable. But here, debugger is on entirely different OS, an entirely different environment. I just say <code>file-&gt;open source files</code> and I AM able to put breakpoints!! Moreover when I load driver, it actually breaks there. I mean why../How? How does XP's kernel comes to know(drivers are extension to kernel, atleast WDM, don't know about WDK) that there is source code of <code>this</code> driver? and that also outside its control(environment)? I mean I can have 10 files open with breakpoint in them, but it works beautifully, I am not able to fail/fool it. </p>
  
  <p>So what I am thinking is like, whenever we add source to windbg on Win7, it creates the binary from that source, and whenever XP is going to load any binary, it checks if this is the binary that windbg is waiting for. what is confusing in above link is, Vikrant is saying that debugger asks kernel(XP) that it is willing to debug a process --> Bus HELLO... process is running on XP, and windbg on Win7 and does not know <code>name or id</code> of process.  It has source code, but consider a case where there is a driver which is build out of 300 files, and just one, probably simplest file is open in windbg, how it matched that this source code is of the driver being run?</p>