Questions tagged [kernel]

Mostly used for explaining core components of an operating system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
45 views

Is iOS 15 kernel cache encrypted?

I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user avatar
1 vote
1 answer
25 views

What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice

In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
user avatar
0 votes
0 answers
36 views

Is there any way to extract sandbox bundles since the implementation of monolithic kernelcaches?

I'm trying to obtain the same result that joker -K <bundle> <kernelcache> used to obtain. I tried using jtool2, but it appears that when I'm trying to extract a bundle nothing happens when ...
user avatar
  • 1
1 vote
1 answer
62 views

What does the instructions sequence call/cdqe/ret do?

I'm trying to reverse a Linux module. In the ioctl routine, I have the following sequence of instructions (generated by objdump -M intel -d test.ko): 3f9: 74 3b je 436 <...
user avatar
  • 111
1 vote
1 answer
82 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
user avatar
  • 11
0 votes
0 answers
48 views

viewing debugging symbols in windbg

I am currently learning Malware Analysis using the book "Practical Malware Analysis", and I am going along with the chapter on Kernel debugging. When viewing the same code snippet on WinDbg ...
user avatar
  • 1
2 votes
0 answers
70 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
user avatar
  • 121
1 vote
0 answers
45 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
user avatar
1 vote
1 answer
125 views

Run ntoskrnl.exe with qemu

We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu. Also can .efi files ...
user avatar
  • 11
1 vote
1 answer
71 views

Kernel debug two physical MacBook pro devices

I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?): I'm trying to kernel debug a physical Macbook pro device. When my setup ...
user avatar
  • 638
1 vote
0 answers
88 views

On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?

I have reviewed several sources on this PTE type, including Windows internals and the following: http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
user avatar
2 votes
1 answer
698 views

How to extract the kernel assembly code from a zImage?

here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
user avatar
0 votes
1 answer
73 views

How much of the kernel does remote kernel debugging allow you to debug?

This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have. What ...
user avatar
1 vote
1 answer
111 views

Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions

I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
user avatar
  • 63
0 votes
0 answers
48 views

exports kernel Windows for informations on hardware

Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
user avatar
  • 21
0 votes
0 answers
22 views

Load an IDB file when debugging kernel to get the function names in IDA?

I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files. Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
user avatar
1 vote
1 answer
91 views

Windbg .thread command is useless?

The ".thread" command is used to change the thread context in Windows kernel debugging. MSDN But I encountered the below situation: Execute the following two commands consecutively. The ...
user avatar
  • 117
1 vote
1 answer
40 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
user avatar
2 votes
1 answer
86 views

Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
user avatar
0 votes
1 answer
37 views

Why would just two bits of the SP be used here?

This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7. ; Registers used: ; - r3 : unsigned long argp 0000005c mov r1, ...
user avatar
  • 137
1 vote
1 answer
82 views

How to keep symbols when taking memory snapshot with IDA?

When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this? for example this is ...
user avatar
0 votes
1 answer
91 views

Where is the IMCR defined in the docs?

I'm currently programming a x64 kernel and need to set the Apic mode to symmetric I/O Mode. The Multiprocessor Specification from Intel at Page 31 says that to enable this mode you have to write 01H ...
user avatar
  • 3
0 votes
1 answer
103 views

How to resolve major function numbers to their name while reversing windows drivers?

I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to ...
user avatar
0 votes
3 answers
517 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
user avatar
  • 451
2 votes
1 answer
383 views

WinDBG doesn't resolve function names when debugging kernel module

I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically). Here is a picture ...
user avatar
  • 451
1 vote
1 answer
268 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
user avatar
2 votes
1 answer
181 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
user avatar
  • 21
2 votes
1 answer
260 views

Get return address from syscall

I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
user avatar
3 votes
2 answers
520 views

Windows - syscalls being called in a strange way?

I've been reading about the way syscalls are called in windows. The general theme in all the articles I read is: 64bit- called inside ntdll 32bit- from ntdll jumping to KiFastSystemcall but when I ...
user avatar
1 vote
0 answers
89 views

Windows or Linux x86 Scheduler instructions

I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels. I have read there is a kind of "timer" inside CPU. This timer gives "time slices" to each process. ...
user avatar
  • 583
1 vote
1 answer
653 views

Where can you find the name of a driver causing a kernel mode crash?

I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know. There is a driver that is ...
user avatar
  • 1,196
0 votes
0 answers
53 views

How large are privileges of linux kernel module?

I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...
user avatar
0 votes
1 answer
842 views

Remote debugging using IDA, connecting to windbg server (kernel mode)

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
user avatar
2 votes
2 answers
510 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
user avatar
3 votes
2 answers
2k views

windbg - Why does the GS register resolve to offset 0x0?

I'm trying to understand how to resolve segment addressing (specifically the GS register in X64). My toy program: int main() { unsigned long long x; __debugbreak(); x = __readgsqword(...
user avatar
  • 145
1 vote
1 answer
1k views

windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?

[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959] I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
user avatar
  • 145
3 votes
1 answer
970 views

How to use windbg to view assembly code of kernel function?

I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
user avatar
1 vote
1 answer
590 views

How to identify which iOS kernelcache is installed?

I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an ...
user avatar
  • 166
3 votes
1 answer
355 views

Questions about enabling special pool on win32k

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10 Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
user avatar
1 vote
0 answers
396 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
user avatar
2 votes
1 answer
3k views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...
user avatar
12 votes
3 answers
844 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
user avatar
  • 221
4 votes
1 answer
403 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
user avatar
  • 143
2 votes
2 answers
2k views

How does QPST work and how can I make an app like it?

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(...
user avatar
2 votes
1 answer
178 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
user avatar
2 votes
0 answers
432 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
user avatar
1 vote
1 answer
82 views

HighWaterNumberOfObjects/Handles meaning?

I've been looking at some kernel debugging and came to see this: 0: kd> dt nt!_OBJECT_TYPE ffffd0851aad6c90 +0x000 TypeList : _LIST_ENTRY [ 0xffffd085`1aad6c90 - 0xffffd085`1aad6c90 ] ...
user avatar
  • 13
7 votes
2 answers
2k views

Getting the current process in Windows

While reading Practical Reverse Engineering by Bruce Dang, I came across the following. Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
user avatar
  • 173
4 votes
2 answers
565 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
user avatar
  • 43
3 votes
2 answers
2k views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
user avatar
  • 51