1

I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is there any other way I can extract them? I did some quick searching and didn't see anything useful.

Thanks

1

Updated on 2014-12-08

As discussed at http://microsoft.public.windbg.narkive.com/7opF4257/kernel-dump-rdmsr, MSRs aren't saved in crash-dumps. But you could create a driver that registers a system bug-check callback (via KeRegisterBugCheckReasonCallback()) and dumps the MSRs of interest when called.

  • I probably should have specified in the question that I'm focusing on ones pertaining to syscalls. I'm going through the list now but do you know off the top of your head if there's one for those? – Fewmitz Dec 6 '14 at 19:44
  • What do you mean, "pertaining to syscalls" in this context? – Jason Geffner Dec 6 '14 at 19:53
  • When you make a syscall it redirects to the IA32_LSTAR MSR. This is the one I'm most interested in pulling as it is a potential hook point for malware if it has rootkit capabilities. – Fewmitz Dec 7 '14 at 20:10
  • I've updated my answer above. – Jason Geffner Dec 8 '14 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.