It is necessary to find address on the structure kdDebuggerDataBlock,
which is located somewhere at kernel .data section.

We can find it in structure defined in kernel:
typedef struct _DBGKD_DEBUG_DATA_HEADER
{
    LIST_ENTRY64 List;
    ULONG OwnerTag;
    ULONG Size;
} DBGKD_DEBUG_DATA_HEADER, *PDBGKD_DEBUG_DATA_HEEADER;
where OwnerTag == 'KDBG',
then List == kdDebuggerDataBlock.

Signed-off-by: Mikhail Abakumov <mikhail.abakumov@ispras.ru>
Signed-off-by: Pavel Dovgalyuk <dovgaluk@ispras.ru>
---
 target/i386/windbgstub.c |   47 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/target/i386/windbgstub.c b/target/i386/windbgstub.c
index dc58f5a8cc..f1bab10b10 100644
--- a/target/i386/windbgstub.c
+++ b/target/i386/windbgstub.c
@@ -14,6 +14,7 @@
 
 #ifdef TARGET_X86_64
 #define OFFSET_KPCR_SELF 0x18
+#define OFFSET_KPCR_LOCK_ARRAY 0x28
 #else  /* TARGET_I386 */
 #define OFFSET_KPCR_SELF 0x1C
 #define OFFSET_KPCR_VERSION 0x34
@@ -60,6 +61,52 @@ static bool find_KPCR(CPUState *cs)
 #ifdef TARGET_X86_64
 static bool find_kdDebuggerDataBlock(CPUState *cs)
 {
+    target_ulong lockArray;
+    target_ulong dDataList;
+    const uint8_t tag[] = { 'K', 'D', 'B', 'G' };
+    target_ulong start = 0xfffff80000000000LL;
+    target_ulong finish = 0xfffff81000000000LL;
+    InitedAddr find;
+
+    /* kdDebuggerDataBlock is located in
+         - range of [0xfffff80000000000 ... 0xfffff81000000000]
+         - at offset of ('KDBG') - 0x10 */
+
+    if (!kdDebuggerDataBlock.is_init && KPCR.is_init) {
+        /* At first, find lockArray. If it is NULL,
+           then kdDebuggerDataBlock is also NULL (empirically). */
+        lockArray = VMEM_ADDR(cs, KPCR.addr + OFFSET_KPCR_LOCK_ARRAY);
+        if (!lockArray) {
+            return false;
+        }
+        DPRINTF("find LockArray " FMT_ADDR "\n", lockArray);
+
+        while (true) {
+            find = windbg_search_vmaddr(cs, start, finish, tag,
+                                        ARRAY_SIZE(tag));
+            if (!find.is_init) {
+                return false;
+            }
+
+            /* Valid address to 'KDBG ' is always aligned */
+            if (!(find.addr & 0xf)) {
+                dDataList = VMEM_ADDR(cs, find.addr - 0x10);
+
+                /* Valid address to 'dDataList ' is always
+                   in range [0xfffff80000000000 ... 0xfffff8ffffffffff] */
+                if ((dDataList >> 40) == 0xfffff8) {
+                    kdDebuggerDataBlock.addr = find.addr - 0x10;
+                    kdDebuggerDataBlock.is_init = true;
+                    DPRINTF("find kdDebuggerDataBlock " FMT_ADDR "\n",
+                            kdDebuggerDataBlock.addr);
+                    break;
+                }
+            }
+
+            start = find.addr + 0x8; /* next addr */
+        }
+    }
+
     return kdDebuggerDataBlock.is_init;
 }
 #else  /* TARGET_I386 */