I am now using windbg for dual-machine debugging.
I loaded my own graphics driver kernel kernel.sys on the target machine, and then used the .load externel.dll command in windbg to load a dynamic link library.
In my driver code, I set a config structure containing the function pointer of the kernel function I want to call. In the dynamic library externel, use the getsymboltype and getfieldoffset
to get the function.

I make an break in windbg, and then use !dd_external to call the kernel function by calling the method in external.dll.
The result is that the function pointer address I got is the same as the address of x kernel!function
in windbg, but windbg shows c0000005. Is it because external.dll does not have permission to access the kernel function? And how to manually call kernel functions when debugging Windows kernel drivers?