There were times when I want to trace instructions from User Mode and continue tracing it into Kernel mode to reverse Windows's internal implementation with my own supplied parameters from User Mode but there were a big problem and that was, How to access User Mode when you are in a Kernel Debugger or vice versa.
Even if I knew about changing debugger context to specific process but there were other problems which cause reversing kernel in this case, impossible.
First of all, a Kernel Debugger Windbg is needed in order to continue tracing in Kernel.
The first essential thing is we need to change the current process context (fs or gs registers) to be able to access user-mode space of the process which we need to trace its functions.
Which will notify you when the processor reaches to this process.
Next step is to let windbg continue and it will notify you whenever it reaches to the desired process, so press g.
It's getting a little tricky here.
Remember you just loaded the symbols of Kernel-mode modules but now we need user-mode modules' symbol to find the functions.
And wait till all current modules symbol become loaded.
In this post, I'm gonna break on NtQuerySystemInformation which is a native function of ntdll but you can also break on everything you need, depend on address and symbol files(You can also break on your modules by loading their .pdb files.).
Because if you continue debugging, it is possible that kernel switches its context and your breakpoint hits for the second time and you will lose everything!
This problem can be solved by disabling the breakpoint so every time the kernel switches its context then windbg continues until you reach the last point where you were debugging that instruction.
I always use bl in order to view and disable my breakpoints.
Hope you guys have a sweet kernel exploring!