2

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging checks so using WinDbg isn't an option. I have tried VMWare gdb stub connected with IDA but tracing seems to doesn't work, it hangs and even few hours aren't enough. Have you any ideas how to do it in the simplest way?

3
  • 2
    Please show the specific issue. Your current topic is huge.
    – Biswapriyo
    May 19 '19 at 16:30
  • @Biswapriyo My question is how to make driver execution trace (like WinDbg t command, address + all registers state) in the simplest way but not using WinDbg, I need something lower level.
    – kozera2137
    May 19 '19 at 16:43
  • 1
    windbg == dynamic analysis whereas IDA == static analysis.
    – Biswapriyo
    May 19 '19 at 17:05
0

It’s not geared towards exactly this purpose but you can probably make something based on Bochspwn:

Bochspwn Reloaded is an instrumentation module for the Bochs IA-32 emulator, similar to the original Bochspwn project from 2013. It performs taint tracking of the kernel address space of the guest operating systems, to detect the disclosure of uninitialized kernel stack/heap memory to user-mode and other data sinks.

3
  • I thought about it but I couldn't figure out how to run Windows 10 on it. Have you ever tried and can give me some tips? Each tutorial I have seen wasn't working.
    – kozera2137
    May 22 '19 at 14:20
  • Does it have to be win10? Maybe the driver will run in an older version
    – Igor Skochinsky
    May 22 '19 at 14:45
  • Yes, for a few reasons it have to be Windows 10.
    – kozera2137
    May 22 '19 at 15:54
0

These days you may be able to use Icebox (and related projects) to achieve the required level introspection into the driver.

I am unsure if this will be yielding the results you hope for, but it builds on an idea I first came across at the VirusBulletin conference in 2013. The whole thesis can be found here. Icebox appears to build on the same principle and is completely FLOSS, whereas the original CXPInspector by Willems and Hund never was (to the best of my knowledge). Their initial work was commercialized into something known as VMRay today.

It's not exactly tracing you will get with this, but the authors of the seminal work remarked at the conference how they often managed to pin down a particular page access to a particular function call, so this approach provides more introspection than one would think at first glance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.