A Windows kernel-mode debug message viewer with a WinForms GUI. Grease

Traditional kernel debuggers (WinDbg, KD) require enabling kernel debug mode and rebooting:

bcdedit /debug on
bcdedit /dbgsettings ...

This puts the system into a special state and slows it down.

(a bit from Ai):

Grease works on a normal, unmodified Windows boot. It loads as a standard demand-start WDM driver and communicates with the GUI over DeviceIoControl. No kernel debug transport, no second machine, no reboot into debug mode - just install the driver and go.

• Kernel session — attach to the Windows kernel and capture DbgPrint output, process/thread create/exit events, and module load events
• Process sessions — attach to up to 8 user-mode processes simultaneously and capture their debug output
• Software breakpoints — set and remove INT3 breakpoints in kernel or user space; inspect x64 register context (RAX–R15, RFLAGS) on hit
• Symbol resolution — load PDB files into the kernel driver to resolve addresses to module!function names
• Message queue — lock-free ring buffer (4096 entries) with rate limiting (10 000 msg/window) and overflow tracking
• Output filtering — filter by severity (INFO / WARNING / ERROR / BREAKPOINT), source (kernel, driver, process), and event type (thread, module, process events)
• Themes — Dark, White, and Pink built-in themes; selection persisted across sessions
• Driver installer — install, start, stop, and uninstall Grease.sys directly from the UI without touching sc.exe

┌─────────────────────────────────────┐
│         Grease.exe  (WinForms)      │
│  MainForm ─ SessionManager          │
│  OutputPanel ─ DetailsPanel         │
│  DriverComm  (DeviceIoControl)      │
└──────────────┬──────────────────────┘
               │  IOCTL over \\.\Grease
┌──────────────▼──────────────────────┐
│         Grease.sys  (WDM driver)    │
│  KernelSession   ProcessSession     │
│  BreakpointManager  SymbolResolver  │
│  MessageQueue  (ring buffer)        │
└─────────────────────────────────────┘

All codes use device type 0x8000 and METHOD_BUFFERED.

1. Install the Windows Driver Kit matching your Visual Studio version.
2. Open Grease.sln in Visual Studio 2022.
3. Select the Kernel project, set configuration to Debug x64 or Release x64.
4. Build — the output is Grease.sys.

1. Select the Grease (C#) project in the same solution.
2. Build — targets .NET Framework 4.7.2.

Administrator privileges are required.

1. Enable test-signing if you are using an unsigned build:

   bcdedit /set testsigning on
   

   Reboot after running this command.

2. Launch Grease.exe as Administrator.

3. Click Install Driver in the toolbar, select the compiled Grease.sys, and confirm. The driver is copied to %SystemRoot%\System32\drivers\ and registered as a demand-start service.

4. Click Attach Kernel to start capturing kernel-level events, or Attach Process to pick a running process by PID.

5. Debug messages appear in the Output panel in real time. Double-click any message to see full details and register context in the Details panel.

6. Use Output Filter in the toolbar to show or hide specific severity levels, sources, or event types.

7. Use File → Save Output to export the current message log to a .txt file.

From the application: stop all sessions, then use the SCM or sc.exe:

sc stop Grease
sc delete Grease
del %SystemRoot%\System32\drivers\Grease.sys

Or call DriverInstaller.Uninstall() programmatically — it stops the service, deletes the SCM entry, and removes the .sys file.