Questions tagged [driver]

Kernel-mode executables used to communicate between the OS and peripherals.

0
votes
0answers
23 views

Reverse engineer Apple T2/SSD driver for linux

I wasn't exactly sure if this is the right place, as opposed to thinkdifferent or stackoverflow but I figure this might be a good place to start. I have a Macbook Pro 2018 15-inch laptop and want to ...
1
vote
1answer
219 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
1answer
192 views

Reverse engineering a USB Fight Stick

I am completely new to reverse engineering. I have a Razer Atrox Xbox One Fight Stick that I purchased recently. It does not work with windows 10 with the drivers installed by Microsoft version (10....
1
vote
1answer
80 views

Cannot load driver to memory

I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other ...
2
votes
0answers
143 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
1
vote
1answer
297 views

Break on driver loading with windbg

I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
3
votes
3answers
2k views

Reverse engineering USB peripheral driver

I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer ...
1
vote
1answer
75 views

Redirecting Program Output from /dev/*char_device* to Text File

I am currently trying to reverse an IoT machine running the 2.6 Linux Kernel on which I have root. On this machine, software writes to /dev/some_device to control what I believe to be are GPIO pins ...
0
votes
1answer
90 views

RE USB-Serial device driver [Canon ES-E1 for EOS-1V]

I've got an old film camera that uses a cable to connect to a PC. The camera records information like shutter speed, lens used, flash fired, focal length, etc. I'd like to download this information ...
2
votes
2answers
891 views

IOCTL Code for Windows driver

Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
1
vote
0answers
22 views

FFC on the back of a Chromebook Pixel Display Assembly

Hello! I want to get the touch overlay of a Chromebook Pixel Display Assembly to work. I attached a picture of the Cable coming out of a mxT1664S touch controller. Can someone tell me what type of ...
2
votes
1answer
190 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
1
vote
1answer
735 views

Loading a .sys file into Immunity Debugger

Can somebody tell me how to load a .sys file into Immunity Debugger correctly ? Because when I load a driver into Imm. Debugger then I get the message that HAL.dll could not be found and that Imm. ...
2
votes
1answer
293 views

igdlh64.inf modify custom resolution

I have some dead pixels in top couple of rows of my cheap Win 10 tablet. To alleviate that, I wanted to use the custom resolution option in Intel graphics management panel, however, I cannot choose ...
1
vote
1answer
319 views

Using IDA to automatically annote dynamically imported functions in a driver

I've got an x64 Windows driver where a lot of functions are dynamically imported using MmGetSystemRoutineAddress. The function takes a UNICODE_STRING as a parameter to tell it what function to find ...
0
votes
1answer
127 views

Get driver binary

I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys ...
3
votes
2answers
1k views

How to import Windows DDK headers into IDA?

Currently I'm reversing a Windows driver, and there are a lot of structs IDA doesn't automatically recognize, which means I have to import them manually by parsing C header files. However, there are ...
2
votes
2answers
1k views

how to locate linux kernel module module_init(function), function offset from ELF header?

The header is self explanatory but to explain my self better. I have an ELF binary - loadable kernel module, compiled with symbols. I want to know how to locate the offset of the init function. Can i ...
1
vote
0answers
70 views

How can I control a USB device if I have a driver for it, but no application?

I have a Apogee filter-wheel which is connected via USB and the driver for it. However, as far as I could find out the device only comes with a driver but no application to control it. The filter ...
-1
votes
1answer
67 views

Is there any windows API to execute thread on atomic mode? [closed]

Is there any windows API (application program interface) to execute thread on atomic mode?
0
votes
1answer
83 views

how calculate size of memory that allocated from create specific windows object? [closed]

how calculate size of memory that allocated from create specific windows object e.g. how memory allocated when createsemaphore API is called? there are any document that describe for all objects?
1
vote
0answers
193 views

How get a full memory dump of a running specific process from kernel mode by driver?

How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
1
vote
2answers
583 views

Confused about calling convention in a Windows kernel mode driver

Reverse engineering a kernel mode driver (in its 32-bit x86 incarnation) I stumbled over what seems to be an odd calling convention. For a driver I'd expect to see __cdecl, __fastcall and __stdcall in ...
-2
votes
1answer
561 views

How rootkits hide services on kernel mode? [closed]

How rootkits hide services on kernel mode? thanks
2
votes
0answers
1k views

lm command on Windbg is not showing all modules

I'm trying to reverse-enginering a Win7 32bit legacy driver. If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name ...
1
vote
1answer
458 views

Patch driver loading process [closed]

Introduction Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog ...
1
vote
1answer
644 views

Address of loaded driver on memory [closed]

How find address of loaded specific driver on memory by C language in windows os thanks
1
vote
1answer
287 views

How to find status and path of the specific module with C in the windows? [duplicate]

How to find status and path of the specific module with C in the windows? such as windbg lm (list loaded module) kd> lm m cdd start end module name 93ae0000 93afe000 cdd (...
4
votes
3answers
7k views

Kernel debugging - how to set breakpoint at DriverEntry?

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
4
votes
1answer
2k views

Reverse engineering a proprietary GPU device driver?

I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver ...
1
vote
1answer
410 views

What does Device Extension means [closed]

PDEVICE_EXTENSION is a Structure. And fdo is device structure object. PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION) fdo->DeviceExtension; What Does it mean about the following code?
1
vote
0answers
348 views

StrongOD Driver missing

Rather short question. So i've taken to using StrongOD for Ollydbg and I noticed that the fengyue0.sys doesn't exist, I had googled around and restarted my computer in hopes it would be created, yet ...
4
votes
1answer
275 views

Does anyone recognize this keyboard encoding scheme?

I am finalizing the reverse-engineering of a linux driver for the Perixx MX-2000 IIB mouse. One of the features the mouse has is arbitrary button mapping. I can assign a button to produce various keys ...
2
votes
2answers
409 views

Determine encrypted/hashed/compressed proprietary driver file

I have a file that I am trying understand its structure and format. It's a proprietary driver file of a control system for NEC LT380 projector which contain essential information such as TCP port ...
4
votes
1answer
701 views

Is nVidia Linux driver reverse engineering legal in Europe?

How does nvidia linux driver eula, especially sections 2.1.3 and 5. play with European Union Directive on the legal protection of computer programs? I think somebody would have already done that and ...
5
votes
1answer
1k views

Using a VMM/hypervisor to monitor guest OS execution?

I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
9
votes
3answers
2k views

Did somebody start to reverse engineer the proprietary Linux Brother Cups drivers?

I'm not very experienced with graphic or printer formats. My first (and only try yet) was to print a Tux.png with 265 x 314 pixel via the Chromium browser and see what Wireshark shows as USB transfer. ...
3
votes
1answer
1k views

Loading a Driver in Immunity

It sounds strange and I realize that you usually use WinDbg to debug drivers, but I was reading up on Gray Hat Python and it states: To test this out, try loading the driver C:\WINDOWS\System32\...
10
votes
1answer
725 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...
3
votes
1answer
6k views

Reverse engineering flexlm license management

I have a 3D driver from the early 90's for Solaris 2.5-2.6 Sparc that uses flexlm to handle license management. How would I go about either circumventing or removing it for computer archeology/hobby ...
17
votes
4answers
3k views

How can you reliably unpack a Windows driver manually?

When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
5
votes
1answer
416 views

Reverse engineering a Solaris driver

I have several Solaris 2.6 era drivers I would like to reverse engineer. I have a Sparc disassembler which provides some info but it isn't maintained anymore so I think it may not give me all the ...