Good WinDbg Commands for kernel Mode

Dereference the pointer

dx (*(nt!_KTHREAD*)ADDRESS_HERE).PreviousMode

Put a hardware breakpoint on a process for a specific WinAPI (kernel)

ba e1 /p ffff8009bbf4c080 nt!NtWriteVirtualmemory

Show threads in a process

~ , ~1k show 1st thread w/o switching thread, ~0s switching to 0 thread.

Kernel Mode Debugging

!process 0 0 show all processes

nt_ stands for kernel

!trueref and !object ADDRESS_HERE

!irql for IRQL level of current thread.

!idt viewing the registered interrupts

Pattern of derefenercing pointers or pointer of pointer