1

I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with driver entry point. I Use ida pro 7.0 + windbg plugin. I have tried to break as suggested on other question using:

sxe -c ".echo mpAxkSGg3 loaded;" ld:mpAxkSGg3.sys

But it doesn't work for some reason, debugger doesn't break. How can i do this other way? I have discovered, that NtLoadDriver uses MmLoadSystemImageEx but i don't see actualt Driver Entry call there. Can someone guide me the right way to do this?

P.S. I can't modify the driver itself, it is signed with some certificate, so i suppose if i just patch the first bytes to int 3 the whole hash will be invalid, and driver won't load

Improve this question
1
  • Are you certain the driver is an actual driver and not a driver library? It is true that you would invalidate the signature, but on the other hand you should be able to load an unsigned driver with kernel debugger attached. Perhaps there could be issues with ELAM, but I never tested that scenario.
    – 0xC0000022L ♦
    Commented Jun 12, 2018 at 18:44

1 Answer 1

Reset to default
1

bp mpAxkSGg3!DriverEntry should work just fine. Otherwise see which functions mpAxkSGg3.sys exports and set breakpoints on them.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.