I'm just having some fun learning IDA 7.7 Free and how context switching works both on Windows 8.1. I've loaded ntoskrnl.exe
into IDA, but I cannot find the following two functions names or symbols: KiSwapContext
and SwapContext
. I've included the screenshots on loading ntoskrnl.exe and the output details as follows:
> Possible file format: Portable executable for AMD64 (PE) (C:\Program Files\IDA Freeware 7.7\loaders\pe64.dll)
>
> bytes pages size description
> --------- ----- ---- -------------------------------------------- 29450240 3595 8192 allocating memory for b-tree... 29450240 3595
> 8192 allocating memory for virtual array... 262144 32 8192
> allocating memory for name pointers...
> ----------------------------------------------------------------- 59162624 total memory allocated
>
> Loading processor module C:\Program Files\IDA Freeware
> 7.7\procs\pc64.dll for metapc...Initializing processor module metapc...OK Autoanalysis subsystem has been initialized. Loading file
> 'C:\Users\AUSER\Documents\Visual Studio 2019\Reversing\ntoskrnl.exe'
> into database... Detected file format: Portable executable for AMD64
> (PE)
> 0. Creating a new segment (0000000140001000-0000000140289000) ... ... OK
> 1. Creating a new segment (0000000140289000-000000014028C000) ... ... OK
> 2. Creating a new segment (000000014028C000-000000014028F000) ... ... OK
> 3. Creating a new segment (000000014028F000-0000000140290000) ... ... OK
> 4. Creating a new segment (0000000140290000-0000000140291000) ... ... OK
> 5. Creating a new segment (0000000140291000-0000000140305000) ... ... OK
> 6. Creating a new segment (0000000140305000-0000000140343000) ... ... OK
> 7. Creating a new segment (0000000140343000-0000000140346000) ... ... OK
> 8. Creating a new segment (0000000140346000-000000014034E000) ... ... OK
> 9. Creating a new segment (000000014034E000-0000000140361000) ... ... OK
> 10. Creating a new segment (0000000140361000-000000014037B000) ... ... OK
> 11. Creating a new segment (000000014037B000-0000000140658000) ... ... OK
> 12. Creating a new segment (0000000140658000-000000014065D000) ... ... OK
> 13. Creating a new segment (000000014065D000-0000000140685000) ... ... OK
> 14. Creating a new segment (0000000140685000-0000000140688000) ... ... OK
> 15. Creating a new segment (0000000140688000-000000014068F000) ... ... OK
> 16. Creating a new segment (000000014068F000-0000000140694000) ... ... OK
> 17. Creating a new segment (00000001406A8000-00000001406B7000) ... ... OK
> 18. Creating a new segment (00000001406B7000-00000001406C3000) ... ... OK
> 19. Creating a new segment (00000001406C3000-00000001406CE000) ... ... OK
> 20. Creating a new segment (00000001406CE000-0000000140747000) ... ... OK Reading exports directory... Reading imports directory...
> Applying fixups...
> 21. Creating a new segment (0000000140343728-0000000140346000) ... ... OK PDB: using PDBIDA provider Could not find PDB file
> 'ntkrnlmp.pdb'. Please check _NT_SYMBOL_PATH PDB: loading
> C:\symbols\ntkrnlmp.pdb\0E352AF38FB64A36AA56E6CC5CAD6C1A1\ntkrnlmp.pdb
> Assuming __fastcall calling convention by default PDB: loaded 2129
> types 1400240EC: name has been deleted: NtCreateEnlistment 1400240F4:
> name has been deleted: NtCreateResourceManager PDB: total 21006
> symbols loaded for "C:\Users\AUSER\Documents\Visual Studio
> 2019\Reversing\ntoskrnl.exe" Plan FLIRT signature: Windows Driver Kit
> 7/10 64bit Plugin "eh_parse" not found Marking typical code
> sequences... Flushing buffers, please wait...ok File
> 'C:\Users\AUSER\Documents\Visual Studio 2019\Reversing\ntoskrnl.exe'
> has been successfully loaded into the database. Hex-Rays Decompiler
> plugin has been loaded (v7.7.0.220118) License: 00-0000-0000-00 (0
> user) The decompilation hotkey is F5. Please check the
> Edit/Plugins menu for more information. Using FLIRT signature: Windows
> Driver Kit 7/10 64bit Propagating type information... Function
> argument information has been propagated The initial autoanalysis has
> been finished.
[UPDATE] I did a clean install of Windows 8/8.1 on another computer installed IDA Free 7.7 and loaded ntoskrnl.exe into IDA. This time IDA was able to display both KiSwapContext and SwapContext functions very similar output as WinDbg. On the PC which is not displaying these two functions in IDA I tried uninstalling Norton Security but that didn't help. Doing a search for SwapContext in IDA displays the following two functions:
SwapContext_PatchStMxCsr and SwapContext_PatchLdt
Does anyone know why this is the case ? Could this be a windows update patch by Microsoft and the real SwapContext is hidden somewhere else ?