3

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10

Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other drivers)

Because I have a crash that occurs only when enabling special pool specifically on win32kfull.sys by verifier /driver win32kfull.sys /flags 0x1. It doesn't crash when enabling special pool on win32k.sys or win32kbase.sys. Is this case weird?

Also, what would be the general setup regarding turning on the special pool when fuzzing win32k*.sys?

Improve this question
1
  • 1
    I'd strongly suggest you head over to the ntdev mailing list (and forum) on the OSR website. Ask it there, higher chance of getting an answer and higher chance of getting it from someone working on a team that maintains these drivers. Of course you may want to cut down on the notion that you're fuzzing stuff ;)
    – 0xC0000022L ♦
    Commented Nov 19, 2018 at 8:35

1 Answer 1

Reset to default
-1

Just enable special pool on all 3 drivers:

verifier.exe /flags 0x1 /driver win32k.sys /driver win32kbase.sys /driver win32kfull.sys
Improve this answer
4
  • Can you explain how this answers the question? After all the inquirer was asking whether enabling special pool on win32k.sys also affects the other two "companion" drivers. Admittedly this could be seen as addressing the secondary question crammed into the last paragraph by the inquirer.
    – 0xC0000022L ♦
    Commented Nov 19, 2018 at 13:46
  • Actually verifier.exe /flags 0x1 /driver win32k.sys win32kbase.sys win32kfull.sys works.
    – Jaewon Min
    Commented Nov 20, 2018 at 2:16
  • 1
    Well I guess this partially answers my question. The reason I asked is because I couldn't get all 3 drivers to have special pool turned on so was wondering whether turning it on win32k.sys will have similar affect. Now I got all 3 to have special pools turn on, but still the other question I must find out.
    – Jaewon Min
    Commented Nov 20, 2018 at 2:39
  • 1
    verifier /driver win32k.sys /flags 0x1 will enable special pool only for memory allocated in win32k.sys code. It looks like your memory corruption is in a memory chunk allocated in win32kfull.sys, that's why enabling special pool on this driver alone leads to a crash, and enabling it on other drivers does not.
    – clang
    Commented Nov 20, 2018 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.