2

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on rootkitDriverName!DriverEntry doesn't work either for some reason.

Is there any easier way to break on the rootkit driver entry? Why does rootkitDriverName!DriverEntry not work?

Improve this question
1

1 Answer 1

Reset to default
3

Try enabling break on module load:

sxe ld rootkitDriverName

See also https://reverseengineering.stackexchange.com/a/2638/60

Improve this answer
7
  • Thanks, but the problem is, this still doesnt break on the driverEntry of the rootkit driver and instead its in a kernel function related to debugging, and using bu rootkitDriver!DriverEntry doesnt work, it gives this error "Couldn't resolve error". (I am loading the driver using OSRloader)
    – Notoriouss
    Jan 5, 2021 at 5:53
  • with sxe ld you also need !gflag +ksl and a valid pdb and /or .reload /f (couldnt resolve is because you do not have a symbol file )
    – blabb
    Jan 5, 2021 at 13:39
  • @Notoriouss: I think !drvobj should display the entry address so you can set breakpoint there.
    – Igor Skochinsky ♦
    Jan 5, 2021 at 14:50
  • @IgorSkochinsky but !drvobj gives the symbol error as well, i do not have the pdb file for the driver tho, should the symbol get resolved considering i don't have the pdb? i use !drvobj rootkitdrivername, the same name that i registered with OSRloader, and the same one that lm shows
    – Notoriouss
    Jan 6, 2021 at 5:17
  • @Notoriouss are you sure the error is about the driver and not kernel symbols which are necessary for the command to work?
    – Igor Skochinsky ♦
    Jan 7, 2021 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.