I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging checks so using WinDbg isn't an option. I have tried VMWare gdb stub connected with IDA but tracing seems to doesn't work, it hangs and even few hours aren't enough. Have you any ideas how to do it in the simplest way?

  • 1
    Please show the specific issue. Your current topic is huge. – Biswapriyo May 19 '19 at 16:30
  • @Biswapriyo My question is how to make driver execution trace (like WinDbg t command, address + all registers state) in the simplest way but not using WinDbg, I need something lower level. – kozera2137 May 19 '19 at 16:43
  • windbg == dynamic analysis whereas IDA == static analysis. – Biswapriyo May 19 '19 at 17:05

It’s not geared towards exactly this purpose but you can probably make something based on Bochspwn:

Bochspwn Reloaded is an instrumentation module for the Bochs IA-32 emulator, similar to the original Bochspwn project from 2013. It performs taint tracking of the kernel address space of the guest operating systems, to detect the disclosure of uninitialized kernel stack/heap memory to user-mode and other data sinks.

  • I thought about it but I couldn't figure out how to run Windows 10 on it. Have you ever tried and can give me some tips? Each tutorial I have seen wasn't working. – kozera2137 May 22 '19 at 14:20
  • Does it have to be win10? Maybe the driver will run in an older version – Igor Skochinsky May 22 '19 at 14:45
  • Yes, for a few reasons it have to be Windows 10. – kozera2137 May 22 '19 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.