maybe WPA, which lets you sample stack traces from user-mode all the way through drivers? Or DbgView, which lets you see printk output from kernel mode. Or hell, maybe even Windbg debugging the kernel of a Windows VM over simulated serial (you need a checked build of Windows to get the most bang for your buck there, though.)

the hardest-core thing I've done was step my way through Windows startup into the container subsystem, on a real, physical target machine I had connected to my dev machine over FireWire. I felt like Indiana Jones. (It helped having the source code though!)