A forum for reverse engineering, OS internals and malware analysis 

Forum for announcements and questions about tools and software.
 #2337  by GamingMasteR
 Thu Aug 26, 2010 10:27 am
What is LiveCloudKd ?

It is like LiveKd from SysInternals, but it is for Virtualized Windows Operating System running on Microsoft Hyper-V R2.

MoonSols’ LiveCloudKd also allows you to run the Kd and WinDbg from the Microsoft Debugging Tools Package – locally on the host machine – but not for your live system but for all Virtual Machines running in Microsoft Hyper-V R2. It makes it possible to execute all the debugger’s commands that work during the analyzis of a Microsoft crash dump. This includes writing commands – Which makes also possible to modify the memory (code, kernel structures …) of a running Microsoft Hyper-V Virtual Machine.

Using MoonSols LiveCloudKd you can also save the content of the physical memory of a selected Virtual Machine, either in a raw memory dump or in a Microsoft Crash Dump.

Moreover, LiveCloudKd does not require having the debug mode enabled, for both host and guest virtual machines – and LiveCloudKd does not require you to have symbols installed to work ; even if this is strongly recommend if you want to explore the power of Microsoft Kd/WinDbg commands.

LiveCloudKd works with all Windows Virtual Machines from Windows XP to Windows 7/Windows 2008 R2, for both x86 and x64 Editions.
http://www.moonsols.com/2010/08/12/livecloudkd/