Timeline for lm command on Windbg is not showing all modules
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 1, 2015 at 19:26 | comment | added | blabb | try sxe -ibp ;.reboot on the initial break do sxe ld <address> instead of name | |
| Oct 1, 2015 at 19:15 | comment | added | Marco Ramsay Qualcuno | That make sense. At least now, patching the driver I'm able to break the entry point. But I still not understand why I'm unable to break otherwise... | |
| Oct 1, 2015 at 18:41 | comment | added | blabb | you cannot patch the driver without modifying the checksum in peheader | |
| Oct 1, 2015 at 18:00 | comment | added | Marco Ramsay Qualcuno | Also, I tried to patch the "hot patch point" with 0xCC 0x90, but then windows fail to load the driver!! How is possible? | |
| Oct 1, 2015 at 17:58 | comment | added | Marco Ramsay Qualcuno |
Of course entry point is already called if I can see the module through lm. I'll read the answers but I usually break at system startup (with driver NOT loaded), then put a breakpoint with sxe ld name.sys but then nothing happens.
|
|
| Oct 1, 2015 at 17:38 | comment | added | blabb | module is already loaded and driver entry point is already called if you can see the module in lm list to stop at DriverEntryPoint you should break very early (During Phase1/2 init Stage read all the answers in this thread you should be able to find the indirect entry point in your os which is responsible for calling DriverEntry woodmann.com/forum/archive/index.php/t-9201.html i also wrote an answer here which i think was updated for newer os offset search this site | |
| Oct 1, 2015 at 7:03 | comment | added | Marco Ramsay Qualcuno |
Doing .reload when the driver is loaded allow me to show MJ function in terms of module name+offset. lm also show the module. But I'm still unable to set a bp on driver entry. ln addr of DriverEntry doesn't show anything. I tried also bu module_name+offset of EntryPoint with no luck. I think the problem is windbg does not know what "module name" is before I do .reload and so is unable to break on EntryPoint. Any clues?
|
|
| Sep 29, 2015 at 18:51 | comment | added | blabb | use !drvobj \driver\xxxxx 7 it will show you the Address of DriverEntry: do .reload or .reload /f xxxxx.sys and list nearest symbols like ln Address of DriverEntry and not the module name | |
| Sep 29, 2015 at 10:33 | history | asked | Marco Ramsay Qualcuno | CC BY-SA 3.0 |