3

I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.

3

1) you should be aware local kernel debugging is not actual kernel debugging
2) i hope you have enabled /debug on switch in bcdecdit prior to using local kernel debugging feature
3) i hope you are aware a third party app is available which does not require setting /debug on switch

sysinternals livekd

i hope you have properly set the symbol path for downloading symbols using one of the recommended methods like setting an environment variable _NT_SYMBOL_PATH

usage is simple just run windbg ->file->kernel debugging-> local

or from a command line windbg -kl

issue .reload /f so that windbg downloads the required symbol files aka pdbs to the directory you have already set up in _NT_SYMBOL_PATH

now you can examine symbols which you need using x command

x *!*aux*     

here x is the command
the * before ! (called bang in windbg ) is a wildcard for module name
the * after ! (called bang in windbg ) is wildcard for partial symbol name matches

and windbg will show you all the matches for that partially looked up symbols as below

kd> x *!*auxklib*
81f35962          hidusb!AuxKlibGetBugCheckData (<no parameter info>)
81f38dfe          hidusb!AuxKlibQueryModuleInformation (<no parameter info>)
81f38dac          hidusb!AuxKlibInitialize (<no parameter info>)
81f45bc0          HIDCLASS!AuxKlibGetBugCheckData (<no parameter info>)
81f4ace6          HIDCLASS!AuxKlibQueryModuleInformation (<no parameter info>)    <<<<<<<<<<<<<
81f4ac94          HIDCLASS!AuxKlibInitialize (<no parameter info>)
81f5a696          kbdhid!AuxKlibGetBugCheckData (<no parameter info>)
81f5dfcc          kbdhid!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<
81f5df7a          kbdhid!AuxKlibInitialize (<no parameter info>)
81f66612          mouhid!AuxKlibGetBugCheckData (<no parameter info>)
81f69e52          mouhid!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<<<<<
81f69e00          mouhid!AuxKlibInitialize (<no parameter info>)
88c66ff6          Wdf01000!AuxKlibGetBugCheckData (<no parameter info>)
88c79686          Wdf01000!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<<<<<<
88c79634          Wdf01000!AuxKlibInitialize (<no parameter info>)
88c8b418          WDFLDR!AuxKlibQueryModuleInformation (<no parameter info>)  <<<<<<<<<<<<<
88c8b3c6          WDFLDR!AuxKlibInitialize (<no parameter info>)
8957e926          cdrom!AuxKlibGetBugCheckData (<no parameter info>)
8958949c          cdrom!AuxKlibQueryModuleInformation (<no parameter info>)
<<<<<
8958944b          cdrom!AuxKlibInitialize (<no parameter info>)
8f5af972          i8042prt!AuxKlibGetBugCheckData (<no parameter info>)
8f5b51ae          i8042prt!AuxKlibQueryModuleInformation (<no parameter info>)
8f5b515d          i8042prt!AuxKlibInitialize (<no parameter info>)
8f5c291c          kbdclass!AuxKlibGetBugCheckData (<no parameter info>)
8f5c701a          kbdclass!AuxKlibQueryModuleInformation (<no parameter info>)
8f5c6fc8          kbdclass!AuxKlibInitialize (<no parameter info>)
8f5d46b0          mouclass!AuxKlibGetBugCheckData (<no parameter info>)
8f5d8da4          mouclass!AuxKlibQueryModuleInformation (<no parameter info>)
8f5d8d52          mouclass!AuxKlibInitialize (<no parameter info>)
903f4420          igdkmd32!AuxKlibGetImageExportDirectory (<no parameter info>)
903f43ca          igdkmd32!AuxKlibGetBugCheckData (<no parameter info>)
907169cc          igdkmd32!AuxKlibQueryModuleInformation (<no parameter info>)
90716980          igdkmd32!AuxKlibInitialize (<no parameter info>)
9aafd0df          srv2!AuxKlibQueryModuleInformation (<no parameter info>)           
9aafd08e          srv2!AuxKlibInitialize (<no parameter info>)
kd>

since AuxKlibQueryModuleInformation is implemented in many modules then it must be some sort of wrapper to some function which needs to be ascertained by disassembling each function possibly a system call

the uf /c command can disassemble a complete function and shows which child functions are called

if you are using a recent windbg then you can write a javascript to disassemble each function and grep for a common call in all the functions

here is a sample javascript that you can improvise

function exec ( cmdstr ) {
    return host.namespace.Debugger.Utility.Control.ExecuteCommand( cmdstr );
}
function log( instr ){
    host.diagnostics.debugLog( instr + "\n" );
}
function auximpl() {
    var auxkqmi = exec( "x /0 *!*auxklibquerymod*" )
    for ( var line of auxkqmi ) {
        disfun = exec( "uf /c " + line )
        curline = ""
        for ( var a of disfun ) {
            if( ! ( a.includes( "Zw" ) ) ) { 
                curline = a 
            }
            else {
                log( a + "\t@\t" + curline  ) 
                var pstart = (curline.lastIndexOf("(") + 1 )
                var pend = pstart + 8
                var prevstr = "ub " + curline.substring( pstart,pend  ) + " l1"
                var nextstr = "u  " + curline.substring( pstart,pend  ) + " l1" 
                var previnst = exec ( prevstr )
                var nextinst = exec ( nextstr )
                for ( var [b,c] of [previnst , nextinst] ) {
                    log ( b )
                    log ( c )
                }
            }
        }        
    } 
}

results will be as follows

kd> dx @$scriptContents.auximpl()
    call to nt!ZwQuerySystemInformation (8286623c)  @     Wdf01000!AuxKlibQueryModuleInformation+0x8c (87218712):
Wdf01000!AuxKlibQueryModuleInformation+0x8a:
87218710 6a0b            push    0Bh
Wdf01000!AuxKlibQueryModuleInformation+0x8c:
87218712 ff15b8722087    call    dword ptr [Wdf01000!_imp__ZwQuerySystemInformation (872072b8)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     WDFLDR!AuxKlibQueryModuleInformation+0x8c (8722a4a4):
WDFLDR!AuxKlibQueryModuleInformation+0x8a:
8722a4a2 6a0b            push    0Bh
WDFLDR!AuxKlibQueryModuleInformation+0x8c:
8722a4a4 ff157c802287    call    dword ptr [WDFLDR!_imp__ZwQuerySystemInformation (8722807c)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     cdrom!AuxKlibQueryModuleInformation+0x8c (87ad1528):
cdrom!AuxKlibQueryModuleInformation+0x8a:
87ad1526 6a0b            push    0Bh
cdrom!AuxKlibQueryModuleInformation+0x8c:
87ad1528 ff150871ac87    call    dword ptr [cdrom!_imp__ZwQuerySystemInformation (87ac7108)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     i8042prt!AuxKlibQueryModuleInformation+0x8c (8d4d323a):
i8042prt!AuxKlibQueryModuleInformation+0x8a:
8d4d3238 6a0b            push    0Bh
i8042prt!AuxKlibQueryModuleInformation+0x8c:
8d4d323a ff1574e14c8d    call    dword ptr [i8042prt!_imp__ZwQuerySystemInformation (8d4ce174)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     kbdclass!AuxKlibQueryModuleInformation+0x8c (8d4e50a6):
kbdclass!AuxKlibQueryModuleInformation+0x8a:
8d4e50a4 6a0b            push    0Bh
kbdclass!AuxKlibQueryModuleInformation+0x8c:
8d4e50a6 ff152c114e8d    call    dword ptr [kbdclass!_imp__ZwQuerySystemInformation (8d4e112c)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     mouclass!AuxKlibQueryModuleInformation+0x8c (8d4f1e30):
mouclass!AuxKlibQueryModuleInformation+0x8a:
8d4f1e2e 6a0b            push    0Bh
mouclass!AuxKlibQueryModuleInformation+0x8c:
8d4f1e30 ff1524e14e8d    call    dword ptr [mouclass!_imp__ZwQuerySystemInformation (8d4ee124)]
    call to nt!ZwQuerySystemInformation (8286623c)  @     srv2!AuxKlibQueryModuleInformation+0x8c (90d1c16b):
srv2!AuxKlibQueryModuleInformation+0x8a:
90d1c169 6a0b            push    0Bh
srv2!AuxKlibQueryModuleInformation+0x8c:
90d1c16b ff150c63d190    call    dword ptr [srv2!_imp__ZwQuerySystemInformation (90d1630c)]
@$scriptContents.auximpl()
  • May you explain the #1 about "live" kernel debugging vs memory dump. – Biswapriyo Mar 7 at 6:03
  • 2
    debugging a physical machine needs a two computer setup or a physical machine and a vm (two machine ) with live kernel debugging you can step through , set break points , edit memory , etc with local kernel debugging you are inspecting a state of a local machine it does not require two machines the data may be stale if you have a session that you started 5 hours ago and you have created ten other process in the local machine in the mean while local kernel debugging wont show the processes that were created after you started local kernel debugging etc etc etc – blabb Mar 7 at 6:40
  • Would not call livekd a third-party app, considering that Winternals (the company) was bought by Microsoft in 2006 and Mark Russinovich is a technical fellow at Microsoft. – 0xC0000022L Mar 8 at 21:53
  • well subsidiary , sister / daughter concern , ancillary , whatever the point is it is still delivered as sysinternals product and not © microsoft ® corporation – blabb Mar 9 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.