1

I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is there any other way I can extract them? I did some quick searching and didn't see anything useful.

Thanks

Improve this question

1 Answer 1

Reset to default
1

Updated on 2014-12-08

As discussed at http://microsoft.public.windbg.narkive.com/7opF4257/kernel-dump-rdmsr, MSRs aren't saved in crash-dumps. But you could create a driver that registers a system bug-check callback (via KeRegisterBugCheckReasonCallback()) and dumps the MSRs of interest when called.

Improve this answer
4
  • I probably should have specified in the question that I'm focusing on ones pertaining to syscalls. I'm going through the list now but do you know off the top of your head if there's one for those?
    – Fewmitz
    Dec 6, 2014 at 19:44
  • What do you mean, "pertaining to syscalls" in this context?
    – Jason Geffner
    Dec 6, 2014 at 19:53
  • When you make a syscall it redirects to the IA32_LSTAR MSR. This is the one I'm most interested in pulling as it is a potential hook point for malware if it has rootkit capabilities.
    – Fewmitz
    Dec 7, 2014 at 20:10
  • I've updated my answer above.
    – Jason Geffner
    Dec 8, 2014 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.