0

I've been reading a book about reverse engineering assembly code, and although it is very informative, It has questions such as decompile KeReadyThread- Im pretty good at assembly, and want to give it a shot, but how exactly do i view the assembly code of this kernel or any others? thanks

2 Answers 2

2

If you have windbg installed you can use the Local kernel Debugging
Facility to view the Disassembly of any kernel Routine. In OS > WinXP you may need to enable /debug in bcdsettings (boot configuration).

C:\>kd -kl -c "uf nt!KeReadyThread;q" | grep -i -A 20 ke.*:

nt!KeReadyThread:
804fb7de 8bff            mov     edi,edi
804fb7e0 55              push    ebp
804fb7e1 8bec            mov     ebp,esp
804fb7e3 53              push    ebx
804fb7e4 ff1514774d80    call    dword ptr [nt!_imp__KeRaiseIrqlToDpcLevel (804d
7714)]
804fb7ea 8b4d08          mov     ecx,dword ptr [ebp+8]
804fb7ed 8ad8            mov     bl,al
804fb7ef e82e510000      call    nt!KiReadyThread (80500922)
804fb7f4 8acb            mov     cl,bl
804fb7f6 e86d5f0400      call    nt!KiUnlockDispatcherDatabase (80541768)
804fb7fb 5b              pop     ebx
804fb7fc 5d              pop     ebp
804fb7fd c20400          ret     4
quit:
1
  • Thanks, i will try this- wish my book explained more about how the authors got the data
    – Bruce
    Oct 22, 2015 at 2:10
0

Hmmmm not sure on windows but on iOS you have to download the ipsw (firmware file) then unzip it then decrypt it then find the executables you want to look at, I'd imagine windows would be similar but I don't know for sure

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.