2

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on rootkitDriverName!DriverEntry doesn't work either for some reason.

Is there any easier way to break on the rootkit driver entry? Why does rootkitDriverName!DriverEntry not work?

3

Try enabling break on module load:

sxe ld rootkitDriverName

See also https://reverseengineering.stackexchange.com/a/2638/60

7
  • Thanks, but the problem is, this still doesnt break on the driverEntry of the rootkit driver and instead its in a kernel function related to debugging, and using bu rootkitDriver!DriverEntry doesnt work, it gives this error "Couldn't resolve error". (I am loading the driver using OSRloader)
    – Notoriouss
    Jan 5 at 5:53
  • with sxe ld you also need !gflag +ksl and a valid pdb and /or .reload /f (couldnt resolve is because you do not have a symbol file )
    – blabb
    Jan 5 at 13:39
  • @Notoriouss: I think !drvobj should display the entry address so you can set breakpoint there.
    – Igor Skochinsky
    Jan 5 at 14:50
  • @IgorSkochinsky but !drvobj gives the symbol error as well, i do not have the pdb file for the driver tho, should the symbol get resolved considering i don't have the pdb? i use !drvobj rootkitdrivername, the same name that i registered with OSRloader, and the same one that lm shows
    – Notoriouss
    Jan 6 at 5:17
  • @Notoriouss are you sure the error is about the driver and not kernel symbols which are necessary for the command to work?
    – Igor Skochinsky
    Jan 7 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.