when and how to use windbg kernel debugging

Question

I found Windbg is very useful during development and debugging. but mostly i use windbg in use mode debugging.

1. What kernel debugging can do in windbg? or When should I use windbg's kernel debugging?

2. Is there a toturial about kernel debugging in windbg?

Thanks in advance.

Answer 1

you usually use kernel debugging when you need to debug low level device drivers interacting directly with the hardware.
It's more complicated to debug in kernel mode, among other things for a live kernel debug session you have to run the debugger on a different system than the one being debugged . for the majority of developers user mode is enough to do most of the work.
Advanced Windows Debugging is a very good book about debugging with wndbg (includes discussions about kernel debugging).

the dump analysis site has many tutorials including kernel debugging scenarios