How to use windbg to view assembly code of kernel function?

Question

I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.

Answer 1

1) you should be aware local kernel debugging is not actual kernel debugging
2) i hope you have enabled /debug on switch in bcdecdit prior to using local kernel debugging feature
3) i hope you are aware a third party app is available which does not require setting /debug on switch

sysinternals livekd

i hope you have properly set the symbol path for downloading symbols using one of the recommended methods like setting an environment variable _NT_SYMBOL_PATH

usage is simple just run windbg ->file->kernel debugging-> local

or from a command line windbg -kl

issue .reload /f so that windbg downloads the required symbol files aka pdbs to the directory you have already set up in _NT_SYMBOL_PATH

now you can examine symbols which you need using x command

x *!*aux*     

here x is the command
the * before ! (called bang in windbg ) is a wildcard for module name
the * after ! (called bang in windbg ) is wildcard for partial symbol name matches

and windbg will show you all the matches for that partially looked up symbols as below

kd> x *!*auxklib*
81f35962          hidusb!AuxKlibGetBugCheckData (<no parameter info>)
81f38dfe          hidusb!AuxKlibQueryModuleInformation (<no parameter info>)
81f38dac          hidusb!AuxKlibInitialize (<no parameter info>)
81f45bc0          HIDCLASS!AuxKlibGetBugCheckData (<no parameter info>)
81f4ace6          HIDCLASS!AuxKlibQueryModuleInformation (<no parameter info>)    <<<<<<<<<<<<<
81f4ac94          HIDCLASS!AuxKlibInitialize (<no parameter info>)
81f5a696          kbdhid!AuxKlibGetBugCheckData (<no parameter info>)
81f5dfcc          kbdhid!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<
81f5df7a          kbdhid!AuxKlibInitialize (<no parameter info>)
81f66612          mouhid!AuxKlibGetBugCheckData (<no parameter info>)
81f69e52          mouhid!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<<<<<
81f69e00          mouhid!AuxKlibInitialize (<no parameter info>)
88c66ff6          Wdf01000!AuxKlibGetBugCheckData (<no parameter info>)
88c79686          Wdf01000!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<<<<<<
88c79634          Wdf01000!AuxKlibInitialize (<no parameter info>)
88c8b418          WDFLDR!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<
88c8b3c6          WDFLDR!AuxKlibInitialize (<no parameter info>)
8957e926          cdrom!AuxKlibGetBugCheckData (<no parameter info>)
8958949c          cdrom!AuxKlibQueryModuleInformation (<no parameter info>)
<<<<<
8958944b          cdrom!AuxKlibInitialize (<no parameter info>)
8f5af972          i8042prt!AuxKlibGetBugCheckData (<no parameter info>)
8f5b51ae          i8042prt!AuxKlibQueryModuleInformation (<no parameter info>)
8f5b515d          i8042prt!AuxKlibInitialize (<no parameter info>)
8f5c291c          kbdclass!AuxKlibGetBugCheckData (<no parameter info>)
8f5c701a          kbdclass!AuxKlibQueryModuleInformation (<no parameter info>)
8f5c6fc8          kbdclass!AuxKlibInitialize (<no parameter info>)
8f5d46b0          mouclass!AuxKlibGetBugCheckData (<no parameter info>)
8f5d8da4          mouclass!AuxKlibQueryModuleInformation (<no parameter info>)
8f5d8d52          mouclass!AuxKlibInitialize (<no parameter info>)
903f4420          igdkmd32!AuxKlibGetImageExportDirectory (<no parameter info>)
903f43ca          igdkmd32!AuxKlibGetBugCheckData (<no parameter info>)
907169cc          igdkmd32!AuxKlibQueryModuleInformation (<no parameter info>)
90716980          igdkmd32!AuxKlibInitialize (<no parameter info>)
9aafd0df          srv2!AuxKlibQueryModuleInformation (<no parameter info>)           
9aafd08e          srv2!AuxKlibInitialize (<no parameter info>)
kd>

since AuxKlibQueryModuleInformation is implemented in many modules then it must be some sort of wrapper to some function which needs to be ascertained by disassembling each function possibly a system call

the uf /c command can disassemble a complete function and shows which child functions are called

if you are using a recent windbg then you can write a javascript to disassemble each function and grep for a common call in all the functions

here is a sample javascript that you can improvise

function exec ( cmdstr ) {
    return host.namespace.Debugger.Utility.Control.ExecuteCommand( cmdstr );
}
function log( instr ){
    host.diagnostics.debugLog( instr + "\n" );
}
function auximpl() {
    var auxkqmi = exec( "x /0 *!*auxklibquerymod*" )
    for ( var line of auxkqmi ) {
        disfun = exec( "uf /c " + line )
        curline = ""
        for ( var a of disfun ) {
            if( ! ( a.includes( "Zw" ) ) ) { 
                curline = a 
            }
            else {
                log( a + "\t@\t" + curline  ) 
                var pstart = (curline.lastIndexOf("(") + 1 )
                var pend = pstart + 8
                var prevstr = "ub " + curline.substring( pstart,pend  ) + " l1"
                var nextstr = "u  " + curline.substring( pstart,pend  ) + " l1" 
                var previnst = exec ( prevstr )
                var nextinst = exec ( nextstr )
                for ( var [b,c] of [previnst , nextinst] ) {
                    log ( b )
                    log ( c )
                }
            }
        }        
    } 
}

results will be as follows

kd> dx @$scriptContents.auximpl()
    call to nt!ZwQuerySystemInformation (8286623c)  @     Wdf01000!AuxKlibQueryModuleInformation+0x8c (87218712):
Wdf01000!AuxKlibQueryModuleInformation+0x8a:
87218710 6a0b            push    0Bh
Wdf01000!AuxKlibQueryModuleInformation+0x8c:
87218712 ff15b8722087    call    dword ptr [Wdf01000!_imp__ZwQuerySystemInformation (872072b8)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     WDFLDR!AuxKlibQueryModuleInformation+0x8c (8722a4a4):
WDFLDR!AuxKlibQueryModuleInformation+0x8a:
8722a4a2 6a0b            push    0Bh
WDFLDR!AuxKlibQueryModuleInformation+0x8c:
8722a4a4 ff157c802287    call    dword ptr [WDFLDR!_imp__ZwQuerySystemInformation (8722807c)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     cdrom!AuxKlibQueryModuleInformation+0x8c (87ad1528):
cdrom!AuxKlibQueryModuleInformation+0x8a:
87ad1526 6a0b            push    0Bh
cdrom!AuxKlibQueryModuleInformation+0x8c:
87ad1528 ff150871ac87    call    dword ptr [cdrom!_imp__ZwQuerySystemInformation (87ac7108)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     i8042prt!AuxKlibQueryModuleInformation+0x8c (8d4d323a):
i8042prt!AuxKlibQueryModuleInformation+0x8a:
8d4d3238 6a0b            push    0Bh
i8042prt!AuxKlibQueryModuleInformation+0x8c:
8d4d323a ff1574e14c8d    call    dword ptr [i8042prt!_imp__ZwQuerySystemInformation (8d4ce174)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     kbdclass!AuxKlibQueryModuleInformation+0x8c (8d4e50a6):
kbdclass!AuxKlibQueryModuleInformation+0x8a:
8d4e50a4 6a0b            push    0Bh
kbdclass!AuxKlibQueryModuleInformation+0x8c:
8d4e50a6 ff152c114e8d    call    dword ptr [kbdclass!_imp__ZwQuerySystemInformation (8d4e112c)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     mouclass!AuxKlibQueryModuleInformation+0x8c (8d4f1e30):
mouclass!AuxKlibQueryModuleInformation+0x8a:
8d4f1e2e 6a0b            push    0Bh
mouclass!AuxKlibQueryModuleInformation+0x8c:
8d4f1e30 ff1524e14e8d    call    dword ptr [mouclass!_imp__ZwQuerySystemInformation (8d4ee124)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     srv2!AuxKlibQueryModuleInformation+0x8c (90d1c16b):
srv2!AuxKlibQueryModuleInformation+0x8a:
90d1c169 6a0b            push    0Bh
srv2!AuxKlibQueryModuleInformation+0x8c:
90d1c16b ff150c63d190    call    dword ptr [srv2!_imp__ZwQuerySystemInformation (90d1630c)]
@$scriptContents.auximpl()