From a6b3f77b2d1ce2acff3eb892b3f045ad2a0fd0be Mon Sep 17 00:00:00 2001
From: yrp <yrp604@protonmail.com>
Date: Tue, 30 Jul 2019 20:07:37 -0700
Subject: [PATCH] Add notes

---
 README.md | 18 ++++++++++++++++--
 bdump.js  |  2 +-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 1f1f5fe..0c8abb6 100644
--- a/README.md
+++ b/README.md
@@ -4,9 +4,23 @@ A windbg-js plugin to dump the cpu state.
 
 ## Usage
 
+You'll probably want the VM to have 1 vCPU. Sometimes kd gets confused about
+which CPU scripts run on. Additionally, once you hit your bp you should verify
+that `GSBASE` and `KERNEL_GSBASE` are different:
+
 ```
-0: kd> .scriptload c:\path\to\bdump.js
-0: kd> !bdump "c:\\path\\to\\dump"
+kd> rdmsr c0000101
+msr[c0000101] = 0x41414141
+kd> rdmsr c0000102
+msr[c0000102] = 0x42424242
+```
+
+If they are the same, youll need to hit the bp again. I have no idea why this
+happens.
+
+```
+kd> .scriptload c:\path\to\bdump.js
+kd> !bdump "c:\\path\\to\\dump"
 ```
 
 This will create two files:
diff --git a/bdump.js b/bdump.js
index 5fe1b17..e2dbb8f 100644
--- a/bdump.js
+++ b/bdump.js
@@ -318,7 +318,7 @@ function __bdump(path) {
     logln('[bdump] register fixups...');
     __fixup_regs(regs);
     __save_regs(path, regs);
-    logln('[bdump] saving mem...');
+    logln('[bdump] saving mem, get a coffee or have a smoke, this will probably take around 10-15 minutes...');
     __save_mem(path);
 
     logln('[bdump] done!');