2

I'm trying to reverse-enginering a Win7 32bit legacy driver.

If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name show a real object).

But I can't see the driver name in the module list with lm command. Is there an explanation for this?

Because of this I am also unable to break when this module is loaded with sxe ld name but I think that the driver is loaded just after the loading of umbus (because at this time the corresponding DRIVER_OBJECT is created).

Searching on internet I found that this is the "User mode bus enumerator" but I don't understand because it is a kernel mode driver (.sys file).

Improve this question
8
  • 2
    use !drvobj \driver\xxxxx 7 it will show you the Address of DriverEntry: do .reload or .reload /f xxxxx.sys and list nearest symbols like ln Address of DriverEntry and not the module name
    – blabb
    Commented Sep 29, 2015 at 18:51
  • Doing .reload when the driver is loaded allow me to show MJ function in terms of module name+offset. lm also show the module. But I'm still unable to set a bp on driver entry. ln addr of DriverEntry doesn't show anything. I tried also bu module_name+offset of EntryPoint with no luck. I think the problem is windbg does not know what "module name" is before I do .reload and so is unable to break on EntryPoint. Any clues?
    – Marco Ramsay Qualcuno
    Commented Oct 1, 2015 at 7:03
  • module is already loaded and driver entry point is already called if you can see the module in lm list to stop at DriverEntryPoint you should break very early (During Phase1/2 init Stage read all the answers in this thread you should be able to find the indirect entry point in your os which is responsible for calling DriverEntry woodmann.com/forum/archive/index.php/t-9201.html i also wrote an answer here which i think was updated for newer os offset search this site
    – blabb
    Commented Oct 1, 2015 at 17:38
  • Of course entry point is already called if I can see the module through lm. I'll read the answers but I usually break at system startup (with driver NOT loaded), then put a breakpoint with sxe ld name.sys but then nothing happens.
    – Marco Ramsay Qualcuno
    Commented Oct 1, 2015 at 17:58
  • Also, I tried to patch the "hot patch point" with 0xCC 0x90, but then windows fail to load the driver!! How is possible?
    – Marco Ramsay Qualcuno
    Commented Oct 1, 2015 at 18:00

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.