I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my environment for Kernel debugging (using IDA's windbg plugin) and set a breakpoint for the new driver (it's called Fdisk.sys, so I've been typing "bu fdisk.sys!DriverEntry"). However, IDA never breaks when the driver is loaded. I can tell that it has run because it starts hiding a registry key (Ultra3), and dumping the memory and using Volatility to look at unloaded modules, I can see that fdisk.sys was unloaded. I can also confirm that it's installed hooks into a number of kernel API's. How do I get IDA/windbg to break on the driver before it gets to run?
For some reason I have yet to determine, every effort to set a breakpoint on this module by name (fdisk.sys) is failing. The driver isn't loaded at bootup (at least, not at the point that I'm investigating right now). It's loaded by a module and then unloaded again fairly soon thereafter.
I finally used a debugger (indside my VM) to step through the module that launches the driver, stopped execution after the file was written to disk, and used a hex editor to change the first instruction to INT 3. That worked; when the driver loads the exception is caught by the kernel debugger and I'm able to start reviewing. phew
Now I gotta figure out why I couldn't get it break by name.....
It may be late but: If you use WinDBG(kd) to debug the kernel use
sxe -c ".echo fdisk loaded;" ld:fdisk.sys
this is usable in user and kernel mode and cause the debugger break-in after module loaded and before entry-point.
For windbg take a look at my answer here
if you are using virtual kd and vmware just run the script when virtual kd breaks for the first time after the connection
it will simply print out all the driver details as and when they are loaded right from bootphase
for other vms you need to set
sxe -ibp; and reboot and run the script on Initial breakin