Questions tagged [driver]
Kernel-mode executables used to communicate between the OS and peripherals.
56
questions
0
votes
0
answers
83
views
How to exclude "Process Monitor" from Themida's list of monitoring programs
Can Themida be made to whitelist a particular program of its list of "monitoring programs", whether through reversing or compile-flags?
I want to exclude Sysinternals "Process Monitor&...
0
votes
0
answers
88
views
What are the general steps for reverse engineering a windows SPI driver for linux?
I have a fingerprint reader on my laptop that works under windows that doesn't show up on lsusb. Which means its not connected via USB. Through some digging around, I found out that this specific ...
0
votes
0
answers
109
views
Tips on how to extract Apple firmware for a Broadcom Wireless chip, using binwalk or a similar tool?
TLDR: I have a dump of my wireless chip's RAM, but am having trouble separating firmware from, possibly the driver itself, from the nvram configuration portion.
So, I'm trying to enhance the ...
0
votes
1
answer
108
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
3
votes
3
answers
972
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
3
votes
1
answer
348
views
How is lite hash rate (LHR) of Nvidia implemented?
Nvidia limited some of their GPUs with LHR to decrease the performance of Ethereum mining. What in detail is LHR doing? It seems to limit non sequential memory operations (which is actually not what ...
0
votes
0
answers
62
views
exports kernel Windows for informations on hardware
Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
1
vote
0
answers
117
views
Windows: Is it possible to mix FastIoDispatch with the registration of IOCTLs?
I am reverse engineering a Windows device driver. My main previous experience was with drivers I had written before, or toy drivers from tutorials.
I started reversing the driver by searching for ...
0
votes
1
answer
184
views
How to resolve major function numbers to their name while reversing windows drivers?
I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to ...
2
votes
1
answer
1k
views
WinDBG doesn't resolve function names when debugging kernel module
I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).
Here is a picture ...
3
votes
1
answer
887
views
Why does IDA Pro fail to add these constants?
I am trying to port Enrique Nissim's script from his presentation "Reverse Engineering and Bug Hunting on KMDF Drivers" to IDA 7.4. His original script can be found at:
https://github.com/...
1
vote
0
answers
101
views
Same USB packet (Python/user vs C/kernel) but different result
I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device.
Using Wireshark I found what to send and where, so I tried the following command in user space ...
1
vote
1
answer
1k
views
Where can you find the name of a driver causing a kernel mode crash?
I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know.
There is a driver that is ...
0
votes
1
answer
461
views
Info on ProcMon from SysInternals
I need help. I am reversing Procmon64.exe file.
It drops procmon.Sys filesystem minifilter driver which does monitoring.
Question:
I need to know if filtering of events is done in user-mode or ...
1
vote
0
answers
732
views
Reverse engineer Apple T2/SSD driver for linux
I wasn't exactly sure if this is the right place, as opposed to thinkdifferent or stackoverflow but I figure this might be a good place to start. I have a Macbook Pro 2018 15-inch laptop and want to ...
1
vote
1
answer
1k
views
Game's anti-cheat complains when driver test-signing mode is on
I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode.
My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
1
answer
322
views
Reverse engineering a USB Fight Stick
I am completely new to reverse engineering. I have a Razer Atrox Xbox One Fight Stick that I purchased recently. It does not work with windows 10 with the drivers installed by Microsoft version (10....
1
vote
1
answer
144
views
Cannot load driver to memory
I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other ...
3
votes
0
answers
521
views
Cannot debug some drivers with IDA
For some drivers I can use the following WinDBG command:
bu driver!DriverEntry
However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
1
vote
1
answer
983
views
Break on driver loading with windbg
I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
6
votes
3
answers
6k
views
Reverse engineering USB peripheral driver
I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer ...
1
vote
1
answer
118
views
Redirecting Program Output from /dev/*char_device* to Text File
I am currently trying to reverse an IoT machine running the 2.6 Linux Kernel on which I have root. On this machine, software writes to /dev/some_device to control what I believe to be are GPIO pins ...
0
votes
1
answer
349
views
RE USB-Serial device driver [Canon ES-E1 for EOS-1V]
I've got an old film camera that uses a cable to connect to a PC. The camera records information like shutter speed, lens used, flash fired, focal length, etc. I'd like to download this information ...
3
votes
2
answers
3k
views
IOCTL Code for Windows driver
Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
1
vote
0
answers
31
views
FFC on the back of a Chromebook Pixel Display Assembly
Hello!
I want to get the touch overlay of a Chromebook Pixel Display Assembly to work. I attached a picture of the Cable coming out of a mxT1664S touch controller. Can someone tell me what type of ...
2
votes
1
answer
367
views
Trying to reverse engineer teamviewer's printer driver
Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
1
vote
1
answer
2k
views
Loading a .sys file into Immunity Debugger
Can somebody tell me how to load a .sys file into Immunity Debugger correctly ?
Because when I load a driver into Imm. Debugger then I get the message that HAL.dll could not be found and that Imm. ...
2
votes
1
answer
526
views
igdlh64.inf modify custom resolution
I have some dead pixels in top couple of rows of my cheap Win 10 tablet. To alleviate that, I wanted to use the custom resolution option in Intel graphics management panel, however, I cannot choose ...
2
votes
1
answer
584
views
Using IDA to automatically annote dynamically imported functions in a driver
I've got an x64 Windows driver where a lot of functions are dynamically imported using MmGetSystemRoutineAddress. The function takes a UNICODE_STRING as a parameter to tell it what function to find ...
0
votes
1
answer
232
views
Get driver binary
I am running an application that just after starting, it creates a service (process hacker tool notifies me that driver_app.sys has been created). Indeed, it says that the location of driver_app.sys ...
7
votes
2
answers
3k
views
How to import Windows DDK headers into IDA?
Currently I'm reversing a Windows driver, and there are a lot of structs IDA doesn't automatically recognize, which means I have to import them manually by parsing C header files.
However, there are ...
2
votes
2
answers
2k
views
How to locate module_init() offset from ELF header of Linux kernel module?
The header is self explanatory but to explain myself better.
I have an ELF binary - loadable kernel module, compiled with symbols.
I want to know how to locate the offset of the module_init() function....
1
vote
0
answers
102
views
How can I control a USB device if I have a driver for it, but no application?
I have a Apogee filter-wheel which is connected via USB and the driver for it.
However, as far as I could find out the device only comes with a driver but no application to control it. The filter ...
-1
votes
1
answer
84
views
Is there any windows API to execute thread on atomic mode? [closed]
Is there any windows API (application program interface) to execute thread on atomic mode?
0
votes
1
answer
146
views
how calculate size of memory that allocated from create specific windows object? [closed]
how calculate size of memory that allocated from create specific windows object
e.g.
how memory allocated when createsemaphore API is called?
there are any document that describe for all objects?
1
vote
0
answers
263
views
How get a full memory dump of a running specific process from kernel mode by driver?
How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
1
vote
2
answers
1k
views
Confused about calling convention in a Windows kernel mode driver
Reverse engineering a kernel mode driver (in its 32-bit x86 incarnation) I stumbled over what seems to be an odd calling convention. For a driver I'd expect to see __cdecl, __fastcall and __stdcall in ...
-2
votes
1
answer
1k
views
How rootkits hide services on kernel mode? [closed]
How rootkits hide services on kernel mode?
thanks
2
votes
0
answers
2k
views
lm command on Windbg is not showing all modules
I'm trying to reverse-enginering a Win7 32bit legacy driver.
If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name ...
1
vote
1
answer
587
views
Patch driver loading process [closed]
Introduction
Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog ...
1
vote
1
answer
999
views
Address of loaded driver on memory [closed]
How find address of loaded specific driver on memory by C language in windows os
thanks
1
vote
1
answer
575
views
How to find status and path of the specific module with C in the windows? [duplicate]
How to find status and path of the specific module with C in the windows?
such as windbg lm (list loaded module)
kd> lm m cdd
start end module name
93ae0000 93afe000 cdd (...
5
votes
3
answers
13k
views
Kernel debugging - how to set breakpoint at DriverEntry?
I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
5
votes
1
answer
5k
views
Reverse engineering a proprietary GPU device driver?
I have the binary file, and it's over 200 MB in size, which makes me think that such a task by myself would be beyond incredibly difficult to get anything done. I am trying to see how the driver ...
1
vote
1
answer
1k
views
What does Device Extension means [closed]
PDEVICE_EXTENSION is a Structure.
And fdo is device structure object.
PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION) fdo->DeviceExtension;
What Does it mean about the following code?
1
vote
0
answers
487
views
StrongOD Driver missing
Rather short question.
So i've taken to using StrongOD for Ollydbg and I noticed that the fengyue0.sys doesn't exist, I had googled around and restarted my computer in hopes it would be created, yet ...
4
votes
1
answer
333
views
Does anyone recognize this keyboard encoding scheme?
I am finalizing the reverse-engineering of a linux driver for the Perixx MX-2000 IIB mouse. One of the features the mouse has is arbitrary button mapping. I can assign a button to produce various keys ...
3
votes
2
answers
613
views
Determine encrypted/hashed/compressed proprietary driver file
I have a file that I am trying understand its structure and format. It's a proprietary driver file of a control system for NEC LT380 projector which contain essential information such as TCP port ...
5
votes
1
answer
1k
views
Is nVidia Linux driver reverse engineering legal in Europe?
How does nvidia linux driver eula, especially sections 2.1.3 and 5. play with European Union Directive on the legal protection of computer programs?
I think somebody would have already done that and ...
5
votes
1
answer
2k
views
Using a VMM/hypervisor to monitor guest OS execution?
I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...