3

It sounds strange and I realize that you usually use WinDbg to debug drivers, but I was reading up on Gray Hat Python and it states:

To test this out, try loading the driver C:\WINDOWS\System32\beep.sys into Immunity Debugger. Once it's loaded, use the debugger's PyShell and enter the following code:

I'm wondering if this is at all possible. I simply tried loading up beep.sys in Immunity and it cannot find the entry point and doesn't seem to load

Improve this question
4

1 Answer 1

Reset to default
3

edit i didn't realize you are asking for immunity the answer is for plain straight ollydbg 1.10 the concept should be similar in immunity

you need to edit the IMAGE_SUBSYSTEM from IMAGE_SUBSYSTEM_NATIVE to IMAGE_SUBSYSTEM_WINDOWS_GUI or _CUI

ollydbg will now be able to load the driver (imports from hal etc will not be resolved but you can see the correct disassembly if you do alt+e (executable window) select beep.sys right click follow entry

it should be obvious that you do you your experiments on a saved backup copy of system drivers in a vm or a throwaway configuration and not modify originals and break the os to malfunction and burn your machine

open ollydbg alone and use view file to modify subsystem charecteristics to cons
ole or gui instead of native 0000012C    0300        DW 0003              ;  Sub
system = IMAGE_SUBSYSTEM_WINDOWS_CUI

C:\>
C:\>fc /b c:\WINDOWS\system32\drivers\beep.sys c:\myollymodbeep.sys
Comparing files C:\WINDOWS\SYSTEM32\DRIVERS\beep.sys and C:\MYOLLYMODBEEP.SYS
0000012C: 01 03

C:\>"f:\odbg110\OLLYDBG.EXE" c:\myollymodbeep.sys

disasm of beep.sys

0001066C >PUSH    EBP
0001066D  MOV     EBP, ESP
0001066F  SUB     ESP, 0C
00010672  PUSH    EBX
00010673  PUSH    EDI
00010674  PUSH    myollymo.00010652                ;  UNICODE "\Device\Beep"
00010679  LEA     EAX, DWORD PTR SS:[EBP-C]
0001067C  PUSH    EAX
0001067D  CALL    NEAR DWORD PTR DS:[<&ntoskrnl.Rt>;  ntoskrnl.RtlInitUnicodeString
00010683  MOV     EDI, DWORD PTR SS:[EBP+8]
00010686  LEA     EAX, DWORD PTR SS:[EBP-4]
00010689  PUSH    EAX                              ; /*DeviceObject = 001B1EB4
0001068A  XOR     EBX, EBX                         ; |
0001068C  PUSH    EBX                              ; |Exclusive = 7FFD7000
0001068D  PUSH    100                              ; |DeviceCharacteristics = 100
00010692  PUSH    1                                ; |DeviceType = 1
00010694  LEA     EAX, DWORD PTR SS:[EBP-C]        ; |
00010697  PUSH    EAX                              ; |DeviceName = "????"
00010698  PUSH    58                               ; |ULONG DeviceExtensionSize = 58
0001069A  PUSH    EDI                              ; |DriverObject = 001B1EB4
0001069B  CALL    NEAR DWORD PTR DS:[<&ntoskrnl.Io>; \IoCreateDevice
Improve this answer
1
  • I have the same problem. @blabb: I changed the required bit at offset 12c also to 03. After loading the driver into imm. deb. again, it also says that the entry point was not found via exception message at the bottom. I use SHIFT+F7 to pass it to the debugger. I know its a long time ago, but do you need to pass the exception too ?
    – John McMillan
    Commented Dec 26, 2016 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.