LiveKD, a utility I wrote for the CD included with Inside Windows 2000, 3rd Edition, is now freely available. LiveKD allows you to run the Kd and Windbg Microsoft kernel debuggers, which are part of the Debugging Tools for Windows package, locally on a live system. Execute all the debugger commands that work on crash dump files to look deep inside the system. See the Debugging Tools for Windows documentation and our book for information on how to explore a system with the kernel debuggers.
While the latest versions of Windbg and Kd have a similar capability on Windows XP and Server 2003, LiveKD works on NT 4 through Server 2003, including x64 versions of Windows, and enables more functionality, such as viewing thread stacks with the !thread command, than Windbg and Kd's own live kernel debugging facility.
First download and install the Debugging Tools for Windows package from Microsoft's web site:
http://www.microsoft.com/whdc/devtools/debugging/debugstart.mspx
If you install the tools to their default directory of \Program Files\Microsoft\Debugging Tools for Windows, you can run LiveKD from any directory; otherwise you should copy LiveKD to the directory in which the tools are installed.
If you haven't installed symbols for the system on which you run LiveKD, LiveKD will ask if you want it to automatically configure the system to use Microsoft's symbol server (see the Debugging Tools for Windows documentation for information on symbol files and the Microsoft symbol server).
NOTE: The Microsoft debugger will complain that it can't find symbols for LIVEKDD.SYS. This is expected, since I have not made symbols for LIVEKDD.SYS available, and does not affect the behavior of the debugger.
usage: livekd [-w] [-d] [-k ] [debugger options]
All other options are passed through to Kd/Windbg/Dumpchk. Note: Use Ctrl-Break to terminate and restart the debugger if it hangs.