How to find the address (offset) of specific driver function

Question

I am reversing Capcom driver and in IDA I have this list of functions:

I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live debugging.

I set a breakpoint on the userland program before it calls DeviceIoControl and checked the driver object in WinDBG:

kd> dt _DRIVER_OBJECT ffffe78a4b355810
nt!_DRIVER_OBJECT
   +0x000 Type             : 0n4
   +0x002 Size             : 0n336
   +0x008 DeviceObject     : 0xffffe78a`4be95850 _DEVICE_OBJECT
   +0x010 Flags            : 0x12
   +0x018 DriverStart      : 0xfffff80b`f90b0000 Void
   +0x020 DriverSize       : 0xc00
   +0x028 DriverSection    : 0xffffe78a`4d452e80 Void
   +0x030 DriverExtension  : 0xffffe78a`4b355960 _DRIVER_EXTENSION
   +0x038 DriverName       : _UNICODE_STRING "\Driver\cfs"
   +0x048 HardwareDatabase : 0xfffff800`5a5ae8f8 _UNICODE_STRING "\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM"
   +0x050 FastIoDispatch   : (null) 
   +0x058 DriverInit       : 0xfffff80b`f90b063c     long  +0
   +0x060 DriverStartIo    : (null) 
   +0x068 DriverUnload     : 0xfffff80b`f90b047c     void  +0
   +0x070 MajorFunction    : [28] 0xfffff80b`f90b04e4     long  +0

How can I find the address of this function? or its offset cfs+<what_is_the_offset>...

Answer 1

A friend show me how to do it with IDA Python:

from idaapi import *
here() -get_imagebase()

And in WinDBG:

kd> db cfs+0x590
fffff80b`f90b0590  48 53 56 57 48 83 ec 20-48 8b 82 b8 00 00 00 48  HSVWH.. H......H
fffff80b`f90b05a0  8b 7a 18 33 c9 89 4a 30-48 89 4a 38 80 38 0e 44  .z.3..J0H.J8.8.D
fffff80b`f90b05b0  8b 48 10 44 8b 40 08 48-8b da 8b 50 18 74 09 c7  [email protected]..
fffff80b`f90b05c0  43 30 02 00 00 c0 eb 5e-41 bb 44 20 01 aa 8b c1  C0.....^A.D ....
fffff80b`f90b05d0  8b f1 41 3b d3 41 ba 44-30 01 aa 74 0f 41 3b d2  ..A;.A.D0..t.A;.
fffff80b`f90b05e0  75 11 b8 08 00 00 00 8d-70 fc eb 07 be 04 00 00  u.......p.......
fffff80b`f90b05f0  00 8b c6 44 3b c8 75 27-44 3b c6 75 22 41 3b d3  ...D;.u'D;.u"A;.
fffff80b`f90b0600  74 0a 41 3b d2 75 0e 48-8b 0f eb 02 8b 0f e8 11  t.A;.u.H........

Or you can just set the address fffff80b`f90b0590 in the disassembly window.

Answer 2

Your DriverEntry isGiven In Your dt output

+0x058 DriverInit       : 0xfffff80b`f90b063c     long  +0

The Load is Address is Available in the same output

+0x018 DriverStart      : 0xfffff80b`f90b0000 Void

given these 2 the RVA to Driver Entry is 0x63c

find out what the Address Of Driver Entry is in IDA (most probably it will be 0x1063c )

subtract 10590 from 1063c == 0xac set a breakpoint in windbg using

bp  cfs!DriverEntry-0xAC  

which is same as what you answered

FFFFF80BF90B0590

disassembly usingradare2

[0x0001063c]> s $$-0xac
[0x00010590]> af $$
[0x00010590]> pdf $$
            ;-- fcn.00010590:
            ;-- fcn.:
/ (fcn) fcn.$$ 172
|   fcn.$$ (int arg3, int arg4);
|           ; arg int arg3 @ rdx
|           ; arg int arg4 @ rcx
|           ; DATA XREF from entry0 (0x10735)
|           0x00010590      4853           push rbx
|           0x00010592      56             push rsi
|           0x00010593      57             push rdi
|           0x00010594      4883ec20       sub rsp, 0x20
|           0x00010598      488b82b80000.  mov rax, qword [rdx + 0xb8] ; [0xb8:8]=-1 ; 184 ; arg3
|           0x0001059f      488b7a18       mov rdi, qword [rdx + 0x18] ; [0x18:8]=-1 ; 24 ; arg3
|           0x000105a3      33c9           xor ecx, ecx
|           0x000105a5      894a30         mov dword [rdx + 0x30], ecx ; arg4
|           0x000105a8      48894a38       mov qword [rdx + 0x38], rcx ; arg4
|           0x000105ac      80380e         cmp byte [rax], 0xe
|           0x000105af      448b4810       mov r9d, dword [rax + 0x10] ; [0x10:4]=-1 ; 16
|           0x000105b3      448b4008       mov r8d, dword [rax + 8]    ; [0x8:4]=-1 ; 8
|           0x000105b7      488bda         mov rbx, rdx
|           0x000105ba      8b5018         mov edx, dword [rax + 0x18] ; [0x18:4]=-1 ; 24
|       ,=< 0x000105bd      7409           je 0x105c8
|       |   0x000105bf      c74330020000.  mov dword [rbx + 0x30], 0xc0000002 ; [0xc0000002:4]=-1
|      ,==< 0x000105c6      eb5e           jmp 0x10626
|      ||   ; CODE XREF from fcn.$$ (0x105bd)
|      |`-> 0x000105c8      41bb442001aa   mov r11d, 0xaa012044
|      |    0x000105ce      8bc1           mov eax, ecx                ; arg4
|      |    0x000105d0      8bf1           mov esi, ecx                ; arg4
|      |    0x000105d2      413bd3         cmp edx, r11d
|      |    0x000105d5      41ba443001aa   mov r10d, 0xaa013044
|      |,=< 0x000105db      740f           je 0x105ec
|      ||   0x000105dd      413bd2         cmp edx, r10d
|     ,===< 0x000105e0      7511           jne 0x105f3
|     |||   0x000105e2      b808000000     mov eax, 8
|     |||   0x000105e7      8d70fc         lea esi, [rax - 4]
|    ,====< 0x000105ea      eb07           jmp 0x105f3
|    ||||   ; CODE XREF from fcn.$$ (0x105db)
|    |||`-> 0x000105ec      be04000000     mov esi, 4
|    |||    0x000105f1      8bc6           mov eax, esi
|    |||    ; CODE XREFS from fcn.$$ (0x105e0, 0x105ea)
|    ``---> 0x000105f3      443bc8         cmp r9d, eax
|      |,=< 0x000105f6      7527           jne 0x1061f
|      ||   0x000105f8      443bc6         cmp r8d, esi
|     ,===< 0x000105fb      7522           jne 0x1061f
|     |||   0x000105fd      413bd3         cmp edx, r11d
|    ,====< 0x00010600      740a           je 0x1060c
|    ||||   0x00010602      413bd2         cmp edx, r10d
|   ,=====< 0x00010605      750e           jne 0x10615
|   |||||   0x00010607      488b0f         mov rcx, qword [rdi]
|  ,======< 0x0001060a      eb02           jmp 0x1060e
|  ||||||   ; CODE XREF from fcn.$$ (0x10600)
|  ||`----> 0x0001060c      8b0f           mov ecx, dword [rdi]
|  || |||   ; CODE XREF from fcn.$$ (0x1060a)
|  `------> 0x0001060e      e811ffffff     call fcn.00010524
|   | |||   0x00010613      8bc8           mov ecx, eax
|   | |||   ; CODE XREF from fcn.$$ (0x10605)
|   `-----> 0x00010615      8bc6           mov eax, esi
|     |||   0x00010617      890f           mov dword [rdi], ecx
|     |||   0x00010619      48894338       mov qword [rbx + 0x38], rax
|    ,====< 0x0001061d      eb07           jmp 0x10626
|    ||||   ; CODE XREFS from fcn.$$ (0x105f6, 0x105fb)
|    |`-`-> 0x0001061f      c743300d0000.  mov dword [rbx + 0x30], 0xc000000d ; [0xc000000d:4]=-1
|    | |    ; CODE XREFS from fcn.$$ (0x105c6, 0x1061d)
|    `-`--> 0x00010626      33d2           xor edx, edx
|           0x00010628      488bcb         mov rcx, rbx
|           0x0001062b      ff15dffcffff   call qword sym.imp.ntoskrnl.exe_IofCompleteRequest ; [0x10310:8]=0xb2a reloc.ntoskrnl.exe_IofCompleteRequest ; "*\v"
|           0x00010631      8b4330         mov eax, dword [rbx + 0x30] ; [0x30:4]=-1 ; '0' ; 48
|           0x00010634      4883c420       add rsp, 0x20
|           0x00010638      5f             pop rdi
|           0x00010639      5e             pop rsi
|           0x0001063a      5b             pop rbx
\           0x0001063b      c3             ret
[0x00010590]>

Answer 3

What I tend to do is the following.

1. Subtract the base address of the file you loaded in IDA from the address of the function you want to find, e.g: 0x140011011 - 0x140000000 = 0x11011. Now you have the offset.
2. In Windbg obtain the base address of the Capcom driver by doing the following: execute this command in windbg and wait a while: !drvobj Capcom. Eventually you'll get something like this:

Driver object (ffff8c858e479400) is for:
 \Driver\Capcom

Driver Extension List: (id , addr)

Device Object list:
ffff8c858e47a060  

3. Retrieve the address contained between the first set of parentheses and add 0x18 to this address. The reason for this is that an object of type _DRIVER_OBJECT actually contains the driver base address of the driver it's assigned to, which happens to be located at offset 0x18. (This may vary depending on what version of Windows you're using so always verify this by typing this in Windbg and looking for the field named DriverStart. Command: dt nt!_DRIVER_OBJECT.) So in my case, I'll do: 0xFFFF8C858E479400 + 0x18 = 0xFFFF8C858E479418.
4. Input the address acquired in step 3 into your Windbg memory view and retrieve the address located at this address, for me this is 0xFFFFF80376790000.
5. Add the offset we obtained at step 1 to the base address we got at step 4: 0xFFFFF80376790000 + 0x11011 = 0xFFFFF803767A1011.

And there you have it, the function you were looking for is located at 0xFFFFF803767A1011. You should be able to look at this function when inserting this address into your disassembly view.