0

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function where its located in XXX.sys driver i hope that my question was clear also if its possible doing this with windbg would be a lot better for me instead of using a 3rd part software.

i also tried to use Rohitab api monitor but i couldn't understand how does it actually works

  • Hi and welcome to RE.SE. You need to be more specific. Are you exclusively interested in those calls that will end up in one of the SSDTs or are you interested in general in tracing code execution from user mode to kernel mode and back? I am asking because while opening a file, for example, results in a system call, this isn't where the journey ends in kernel mode. Actually that's more the point where it starts, where arguments get re-packaged, get sent to the correct device object where a driver untangles the name and makes sense of it (e.g. inside a file system). So that's a difference. – 0xC0000022L Jul 17 at 19:03
  • @0xC0000022L hi there i basically want to know what function in user mode (ex : user32.dll) calls what internal api like ("NtXXX") and i want to know where is it calling it from is it ntoskrnl.exe is it win32kbase.sys that's all what i want to find a function in a dll that will end up being called in 1 of the kernel system drivers i hope that i made it clear enough. – zeroaceee Jul 17 at 20:35
0

Assuming You Wrote this code
This opens a file in the current Directory
Reads its contents and counts the content length and
Prints to console contents and count

This is a crt function it transistions from
crt to kernel32.dll , kernelbase.dll and ntdll.dll in user mode. and
from ntdll it transitions into kernel mode via a syscall to NtCreateFile in ntoskrnl/ntkrnlmp.exe

#include <stdio.h>
int main (void) 
{
    int c=0,n=0;
    FILE *fp = NULL;
    errno_t err = fopen_s(&fp,"test.txt","rb");
    if(fp != NULL && err == 0)
    {
        do
        {
            n++;
            c = fgetc(fp);
            printf("%c" , c);
        }while(c !=EOF);
        fclose(fp);
    }
    printf("\nfile has %d charecters\n" ,n );
    return n;    
}

you can use windbg uf /c command to create a flow map as shown below
i use dynamic analysis as there are many indirect calls and it is easy to
find the destination dynamically

open fopen.exe in windbg set a break on call fopen_s and hit f5 to break on the call

0:000> rM0
fopen!main+0x29:
00a21029 e892a50000      call    fopen!fopen_s (00a2b5c0)

enter this call and issue a uf /c . (note the .denotes current IP)

0:000> t
fopen!fopen_s:
00a2b5c0 8bff            mov     edi,edi

0:000> uf /c .
fopen!fopen_s (00a2b5c0)
  fopen!fopen_s+0xd (00a2b5cd):
    call to fopen!_errno (00a42ffd)
  fopen!fopen_s+0x17 (00a2b5d7):
    call to fopen!_invalid_parameter_noinfo (00a42ed6)
  fopen!fopen_s+0x29 (00a2b5e9):
    call to fopen!common_fsopen<char> (00a2b383) <<<<<<<<<<<<<<
  fopen!fopen_s+0x37 (00a2b5f7):
    call to fopen!_errno (00a42ffd)

you will notice a call to fopen!common_fsopen

get inside that function and repeat the procedure until you reach the syscall note if the function is inlined you may need to set a bm breakpoint as shown below

0:000> g fopen!common_fsopen<char>
Couldn't resolve error at 'fopen!common_fsopen<char>'
The breakpoint expression "fopen!common_fsopen<char>" evaluates to the inline function.
Please use bm command to set breakpoints first, then g.
                                 ^ Syntax error in 'g fopen!common_fsopen<char>'
0:000> bm fopen!common_fsopen<char>;g
  1: 00a2b383          @!"fopen!common_fsopen<char>"
Breakpoint 1 hit 

the result of procedure thus repeated until crt transitions from itself to kernel32 is shown below scroll to the end

0:000> uf /c .
fopen!common_fsopen<char> (00a2b383)
  fopen!common_fsopen<char>+0x7 (00a2b38a):
    call to fopen!__SEH_prolog4 (00a21b30)
  fopen!common_fsopen<char>+0x13 (00a2b396):
    call to fopen!_errno (00a42ffd)
  fopen!common_fsopen<char>+0x1e (00a2b3a1):
    call to fopen!_invalid_parameter_noinfo (00a42ed6)
  fopen!common_fsopen<char>+0x38 (00a2b3bb):
    call to fopen!_errno (00a42ffd)
  fopen!common_fsopen<char>+0x49 (00a2b3cc):
    call to fopen!__acrt_stdio_allocate_stream (00a44b46)
  fopen!common_fsopen<char>+0x55 (00a2b3d8):
    call to fopen!_errno (00a42ffd)
  fopen!common_fsopen<char>+0x72 (00a2b3f5):
    call to fopen!_openfile (00a45529)
  fopen!common_fsopen<char>+0x86 (00a2b409):
    call to fopen!common_fsopen<char>+0x96 (00a2b419)
  fopen!common_fsopen<char>+0x8d (00a2b410):
    call to fopen!__SEH_epilog4 (00a21b76)
0:000> g fopen!_openfile
eax=0016f870 ebx=7ffd5000 ecx=0016f870 edx=0017a89b esi=00a62194 edi=00a62190
eip=00a45529 esp=0016f848 ebp=0016f88c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
fopen!_openfile:
00a45529 8bff            mov     edi,edi
0:000> uf /c .
fopen!_openfile (00a45529)
  fopen!common_openfile<char>+0x11 (00a4519e):
    call to fopen!__acrt_stdio_parse_mode<char> (00a44cef)
  fopen!common_openfile<char>+0x3a (00a451c7):
    call to fopen!_sopen_s (00a5320a)
0:000> g fopen!_sopen_s
eax=0016f840 ebx=7ffd5000 ecx=00a62190 edx=0017a89b esi=00a62194 edi=00a62190
eip=00a5320a esp=0016f810 ebp=0016f844 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
fopen!_sopen_s:
00a5320a 8bff            mov     edi,edi
0:000> uf /c .
fopen!_sopen_s (00a5320a)
  fopen!_sopen_s+0x16 (00a53220):
    call to fopen!common_sopen_dispatch<char> (00a528eb)
0:000> g fopen!common_sopen_dispatch<char>
Couldn't resolve error at 'fopen!common_sopen_dispatch<char>'
The breakpoint expression "fopen!common_sopen_dispatch<char>" evaluates to the inline function.
Please use bm command to set breakpoints first, then g.
                                         ^ Syntax error in 'g fopen!common_sopen_dispatch<char>'
0:000> bm fopen!common_sopen_dispatch<char>;g
  2: 00a528eb          @!"fopen!common_sopen_dispatch<char>"
Breakpoint 2 hit
eax=0016f840 ebx=7ffd5000 ecx=00a62190 edx=0017a89b esi=00a62194 edi=00a62190
eip=00a528eb esp=0016f7f0 ebp=0016f80c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
fopen!common_sopen_dispatch<char>:
00a528eb 6a10            push    10h
0:000> uf /c .
fopen!common_sopen_dispatch<char> (00a528eb)
  fopen!common_sopen_dispatch<char>+0x7 (00a528f2):
    call to fopen!__SEH_prolog4 (00a21b30)
  fopen!common_sopen_dispatch<char>+0x13 (00a528fe):
    call to fopen!_errno (00a42ffd)
  fopen!common_sopen_dispatch<char>+0x1d (00a52908):
    call to fopen!_invalid_parameter_noinfo (00a42ed6)
  fopen!common_sopen_dispatch<char>+0x5d (00a52948):
    call to fopen!_sopen_nolock (00a5319a)
  fopen!common_sopen_dispatch<char>+0x71 (00a5295c):
    call to fopen!common_sopen_dispatch<char>+0x8b (00a52976)
  fopen!common_sopen_dispatch<char>+0x7f (00a5296a):
    call to fopen!__SEH_epilog4 (00a21b76)
0:000> g fopen!_sopen_nolock
eax=0016f7cc ebx=7ffd5000 ecx=00a62190 edx=0017a89b esi=0016f840 edi=00a62190
eip=00a5319a esp=0016f79c ebp=0016f7ec iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
fopen!_sopen_nolock:
00a5319a 8bff            mov     edi,edi
0:000> uf /c .
fopen!_sopen_nolock (00a5319a)
  fopen!_sopen_nolock+0x1d (00a531b7):
    call to fopen!__acrt_get_utf8_acp_compatibility_codepage (00a4a841)
  fopen!_sopen_nolock+0x2a (00a531c4):
    call to fopen!__acrt_mbs_to_wcs_cp<__crt_win32_buffer_internal_dynamic_resizing> (00a49bea)
  fopen!_sopen_nolock+0x50 (00a531ea):
    call to fopen!_wsopen_nolock (00a53282)
  fopen!_sopen_nolock+0x63 (00a531fd):
    call to fopen!_free_base (00a430ff)
0:000> g fopen!_wsopen_nolock
eax=00000000 ebx=7ffd5000 ecx=8b190463 edx=00000009 esi=0016f840 edi=00a62190
eip=00a53282 esp=0016f75c ebp=0016f798 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
fopen!_wsopen_nolock:
00a53282 8bff            mov     edi,edi
0:000> uf /c .
fopen!_wsopen_nolock (00a53282)
  fopen!_wsopen_nolock+0x18 (00a5329a):
    call to fopen!decode_options (00a52e85)
  fopen!_wsopen_nolock+0x32 (00a532b4):
    call to fopen!__doserrno (00a42fea)
  fopen!_wsopen_nolock+0x3f (00a532c1):
    call to fopen!_errno (00a42ffd)
  fopen!_wsopen_nolock+0x4b (00a532cd):
    call to fopen!_alloc_osfhnd (00a4cc8a)
  fopen!_wsopen_nolock+0x59 (00a532db):
    call to fopen!__doserrno (00a42fea)
  fopen!_wsopen_nolock+0x63 (00a532e5):
    call to fopen!_errno (00a42ffd)
  fopen!_wsopen_nolock+0xa4 (00a53326):
    call to fopen!create_file (00a52d97)
  fopen!_wsopen_nolock+0xe9 (00a5336b):
    call to fopen!create_file (00a52d97)
  fopen!_wsopen_nolock+0x114 (00a53396):
    call to kernel32!GetLastErrorStub (75eccde0)
  fopen!_wsopen_nolock+0x11b (00a5339d):
    call to fopen!__acrt_errno_map_os_error (00a42fc7)
  fopen!_wsopen_nolock+0x127 (00a533a9):
    call to kernel32!GetFileTypeImplementation (75ed6ab4)
  fopen!_wsopen_nolock+0x131 (00a533b3):
    call to kernel32!GetLastErrorStub (75eccde0)
  fopen!_wsopen_nolock+0x13a (00a533bc):
    call to fopen!__acrt_errno_map_os_error (00a42fc7)
  fopen!_wsopen_nolock+0x15a (00a533dc):
    call to kernel32!CloseHandleImplementation (75ece868)
  fopen!_wsopen_nolock+0x168 (00a533ea):
    call to fopen!_errno (00a42ffd)
  fopen!_wsopen_nolock+0x194 (00a53416):
    call to fopen!__acrt_lowio_set_os_handle (00a4cbd3)
  fopen!_wsopen_nolock+0x1e0 (00a53462):
    call to fopen!truncate_ctrl_z_if_present (00a53096)
  fopen!_wsopen_nolock+0x1ee (00a53470):
    call to fopen!_close_nolock (00a45761)
  fopen!_wsopen_nolock+0x215 (00a53497):
    call to fopen!configure_text_mode (00a52b42)
  fopen!_wsopen_nolock+0x2a7 (00a53529):
    call to kernel32!CloseHandleImplementation (75ece868)
  fopen!_wsopen_nolock+0x2ca (00a5354c):
    call to fopen!create_file (00a52d97)
  fopen!_wsopen_nolock+0x2d9 (00a5355b):
    call to kernel32!GetLastErrorStub (75eccde0)
  fopen!_wsopen_nolock+0x2e0 (00a53562):
    call to fopen!__acrt_errno_map_os_error (00a42fc7)
  fopen!_wsopen_nolock+0x300 (00a53582):
    call to fopen!_free_osfhnd (00a4cd93)
0:000> g fopen!create_file
eax=0016f744 ebx=0016f840 ecx=00000000 edx=00000000 esi=0016f744 edi=0016f708
eip=00a52d97 esp=0016f6e4 ebp=0016f758 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
fopen!create_file:
00a52d97 8bff            mov     edi,edi
0:000> uf /c .
fopen!create_file (00a52d97)
  fopen!create_file+0x1d (00a52db4):
    call to kernel32!CreateFileWImplementation (75ece8a5)  <<<<<<<<<<<<<<<<<

kernel32.dll to kernelbase.dll

0:000> uf /c 75ece8a5
kernel32!CreateFileWImplementation (75ece8a5)
  kernel32!CreateFileWImplementation+0xe (75ece8b3):
    call to ntdll!RtlInitUnicodeStringEx (77a76f0a)
  kernel32!CreateFileWImplementation+0x2a (75ece8c8):
    call to kernel32!BaseIsThisAConsoleName (75ece903)
  kernel32!CreateFileWImplementation+0x64 (75ece8ea):
    call to kernel32!CreateFileW (75ece8f8)
  kernel32!CreateFileWImplementation+0x48 (75eea050):
    call to kernel32!OpenConsoleW (75ec0853)
  kernel32!CreateFileWImplementation+0x19 (75eebe96):
    call to kernel32!BaseSetLastNTError (75ecf790)
0:000> uf /c kernel32!CreateFileW
Flow analysis was incomplete, some code may be missing
kernel32!CreateFileW (75ece8f8)
    no calls found
0:000> uf kernel32!CreateFileW
Flow analysis was incomplete, some code may be missing
kernel32!_imp__CreateFileW:
75e819e0 68a7d9755e      push    5E75D9A7h
75e819e5 44              inc     esp

kernel32!CreateFileW:
75ece8f8 ff25e019e875    jmp     dword ptr [kernel32!_imp__CreateFileW (75e819e0)]

as shown below the transition from kernelbase to ntdll and from ntdll to kernelmode since there are many indirect calls you may need to evaluate each of them using run to call (pc) command

0:000> uf /c poi(75e819e0)
KERNELBASE!CreateFileW (75d9a768)
  KERNELBASE!CreateFileW+0x68 (75d9a799):
    call to ntdll!RtlInitUnicodeStringEx (77a76f0a)
  KERNELBASE!CreateFileW+0x9e (75d9a7d3):
    call to ntdll!RtlDosPathNameToRelativeNtPathName_U_WithStatus (77a7a6a1)
  KERNELBASE!CreateFileW+0x312 (75d9a8ed):
    call to KERNELBASE!SbSelectProcedure (75d9a755)
  KERNELBASE!CreateFileW+0x31f (75d9a8fa):
    unresolvable call: call    eax
  KERNELBASE!CreateFileW+0x35c (75d9a937):
    unresolvable call: call    esi
  KERNELBASE!CreateFileW+0x3c8 (75d9a94c):
    call to ntdll!RtlReleaseRelativeName (77a77f7a)
  KERNELBASE!CreateFileW+0x3e6 (75d9a96a):
    unresolvable call: call    esi
  KERNELBASE!CreateFileW+0x3f8 (75d9a97c):
    unresolvable call: call    esi
  KERNELBASE!CreateFileW+0x44e (75d9a997):
    call to ntdll!RtlSetLastWin32Error (77a730fb)
  KERNELBASE!CreateFileW+0x3ff (75d9a9b2):
    call to KERNELBASE!BaseSetLastNTError (75d96b4d)
  KERNELBASE!CreateFileW+0xb8 (75d9f441):
    call to ntdll!RtlSetLastWin32Error (77a730fb)
  KERNELBASE!CreateFileW+0x1a8 (75da16c6):
    call to ntdll!NtQueryInformationFile (77a66058)
  KERNELBASE!CreateFileW+0xc1 (75da446c):
    call to KERNELBASE!BaseSetLastNTError (75d96b4d)
  KERNELBASE!CreateFileW+0x423 (75da73e3):
    call to ntdll!RtlSetLastWin32Error (77a730fb)
  KERNELBASE!CreateFileW+0x46f (75db80bd):
    call to ntdll!ZwSetInformationFile (77a66678)
  KERNELBASE!CreateFileW+0x2f (75dbd130):
    call to KERNELBASE!BaseSetLastNTError (75d96b4d)
  KERNELBASE!CreateFileW+0x1bf (75dbd158):
    call to KERNELBASE!KernelBaseGetGlobalData (75d96843)
  KERNELBASE!CreateFileW+0x1d6 (75dbd16f):
    call to ntdll!RtlAllocateHeap (77a72dd6)
  KERNELBASE!CreateFileW+0x1f8 (75dbd18d):
    call to ntdll!ZwQueryEaFile (77a66008)
  KERNELBASE!CreateFileW+0x213 (75dbd1a8):
    call to ntdll!RtlFreeHeap (77a72c6a)
  KERNELBASE!CreateFileW+0x2c2 (75dbd1d5):
    call to ntdll!RtlReleaseRelativeName (77a77f7a)
  KERNELBASE!CreateFileW+0x2d8 (75dbd1eb):
    call to ntdll!RtlFreeHeap (77a72c6a)
  KERNELBASE!CreateFileW+0x2e3 (75dbd1f6):
    call to KERNELBASE!BaseSetLastNTError (75d96b4d)
  KERNELBASE!CreateFileW+0x3a2 (75dbd247):
    unresolvable call: call    esi
  KERNELBASE!CreateFileW+0x3b8 (75dbd265):
    call to KERNELBASE!AitLogFeatureUsageByApp (75dd0aef)
  KERNELBASE!CreateFileW+0x47a (75dbd27e):
    call to KERNELBASE!BaseSetLastNTError (75d96b4d)
  KERNELBASE!CreateFileW+0x482 (75dbd286):
    call to ntdll!NtClose (77a65508)
0:000> bp poi(75e819e0);g
Breakpoint 0 hit
eax=00000000 ebx=0016f840 ecx=75ece9b9 edx=00000074 esi=0016f744 edi=0016f708
eip=75d9a768 esp=0016f694 ebp=0016f6bc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
KERNELBASE!CreateFileW:
75d9a768 8bff            mov     edi,edi
0:000> pc
eax=0016f668 ebx=0016f840 ecx=75ece9b9 edx=00000074 esi=0017a8d8 edi=0016f708
eip=75d9a799 esp=0016f61c ebp=0016f690 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
KERNELBASE!CreateFileW+0x68:
75d9a799 ff15ec11d975    call    dword ptr [KERNELBASE!_imp__RtlInitUnicodeStringEx (75d911ec)]
ds:0023:75d911ec={ntdll!RtlInitUnicodeStringEx (77a76f0a)}
0:000> pc
eax=0016f668 ebx=00000000 ecx=00000008 edx=00000000 esi=0017a8d8 edi=0016f708
eip=75d9a7d3 esp=0016f614 ebp=0016f690 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
KERNELBASE!CreateFileW+0x9e:
75d9a7d3 ff150414d975    call    dword ptr [KERNELBASE!_imp__RtlDosPathNameToRelativeNtPathName_U_WithStatus
(75d91404)] ds:0023:75d91404={ntdll!RtlDosPathNameToRelativeNtPathName_U_WithStatus (77a7a6a1)}
0:000> pc
eax=00200000 ebx=00000000 ecx=00000000 edx=00000080 esi=00000020 edi=00000000
eip=75d9a8ed esp=0016f610 ebp=0016f690 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
KERNELBASE!CreateFileW+0x312:
75d9a8ed e863feffff      call    KERNELBASE!SbSelectProcedure (75d9a755)
0:000> pc
eax=75d9a760 ebx=00000000 ecx=0016f698 edx=00000000 esi=00000020 edi=00000000
eip=75d9a8fa esp=0016f61c ebp=0016f690 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
KERNELBASE!CreateFileW+0x31f:
75d9a8fa ffd0            call    eax {KERNELBASE!CreateFileDowngrade_Vista (75d9a760)}
0:000> pc
eax=0016f688 ebx=00000000 ecx=0016f62c edx=00000000 esi=77a65608 edi=00000000
eip=75d9a937 esp=0016f5f4 ebp=0016f690 iopl=0         nv up ei ng nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000282
KERNELBASE!CreateFileW+0x35c:
75d9a937 ffd6            call    esi {ntdll!ZwCreateFile (77a65608)}
0:000> t
eax=0016f688 ebx=00000000 ecx=0016f62c edx=00000000 esi=77a65608 edi=00000000
eip=77a65608 esp=0016f5f0 ebp=0016f690 iopl=0         nv up ei ng nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000282
ntdll!ZwCreateFile:
77a65608 b842000000      mov     eax,42h
0:000> pc
eax=00000042 ebx=00000000 ecx=0016f62c edx=7ffe0300 esi=77a65608 edi=00000000
eip=77a65612 esp=0016f5f0 ebp=0016f690 iopl=0         nv up ei ng nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000282
ntdll!ZwCreateFile+0xa:
77a65612 ff12            call    dword ptr [edx]      ds:0023:7ffe0300={ntdll!KiFastSystemCall (77a670f0)}
0:000>

for mapping kernel mode calls you need a kernel debugging session with two machines a host and a target (physical/vm or vm /vm or physial / physical )

set a process specific Break on nt!NtCreateFile and repeat the procedure it willmost likely reach Object Manager calls ObCreateObject() etc before returning back to usermode .

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.