3

I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 code) I cannot step into it:

enter image description here

Can someone show if it's possible to step into a kernel code?

PS. I'm running IDA Pro in a VM from my host Windows system.

Improve this question
13
  • 3
    you cannot step into kernel mode from usermode seamlessly if you have a pair (physc/vm , vm/vm , physc/physc ) set a breakpoint on the Actual System Call in kernel mode and step in to break the one in ntdll is just a stub that transfers the execution to kmode
    – blabb
    Nov 20 '17 at 22:37
  • 1
    a kernel debugger may work I think @blabb
    – Igor Skochinsky ♦
    Nov 22 '17 at 14:19
  • 1
    stackoverflow.com/questions/42776503/… has some ideas and actually mentions IDA, and an answer from blabb :)
    – Igor Skochinsky ♦
    Nov 22 '17 at 14:23
  • @igor yes a kernel debugger connection needs a pair iiur op expects to do it in a single machine
    – blabb
    Nov 22 '17 at 15:57
  • oh indeed, it won’t work on the same box.
    – Igor Skochinsky ♦
    Nov 22 '17 at 16:06
3
+25

In order to step into syscall you must debug your machine from kernel mode debugger. https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf see Debugging the kernel with VMWare section. But be aware, that in kernel mode debugger you won't be able to debug your single process as it was in user mode. Kernel mode debugging is about debugging all the processes in the system. So you'll have to attach to the target process before you can do anything, and you'll need to learn how to set breakpoints, which will trigger only in your target process.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.