Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Mostly used for explaining core components of an operating system.

2
votes
1answer
42 views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...
11
votes
3answers
385 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
2
votes
1answer
57 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
0
votes
2answers
128 views

How does QPST work and how can I make an app like it?

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(...
2
votes
1answer
93 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
1
vote
0answers
129 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
0
votes
0answers
57 views

Finding process offsets

I'm looking to find Offsets for Windows processes to hook in to and change in memory. What's the quickest way to go about this? I tried cheatengine, but unfortunately returns too many results to be ...
1
vote
1answer
57 views

HighWaterNumberOfObjects/Handles meaning?

I've been looking at some kernel debugging and came to see this: 0: kd> dt nt!_OBJECT_TYPE ffffd0851aad6c90 +0x000 TypeList : _LIST_ENTRY [ 0xffffd085`1aad6c90 - 0xffffd085`1aad6c90 ] ...
0
votes
0answers
62 views

Kernel Debugging With Virtualbox on Linux host (ERROR: Win32 error 0n2)

I have a problem with my kernel debugging setup. First of all, I have the following VM configurations: Host: Linux 17.04 (x64) Debugger VM: Win 7 SP1 (x32) with Guest additions installed + WinDBG ...
6
votes
2answers
237 views

Getting the current process in Windows

While reading Practical Reverse Engineering by Bruce Dang, I came across the following. Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
0
votes
0answers
57 views

Symbol issues with radare2 and OSX KEXT module

I'm doing some reverse-engineering on a OSX USB driver, just for fun. I did some progress using otool -jtV and I decided to see how radare2 can help me. But I'm struggling in something rather basic. ...
4
votes
2answers
131 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
0
votes
0answers
140 views

Help identifying unknown boot console UART ARM CPU before U-Boot bootloader and/or read flash image?

I have an embedded Linux device with flash storage, using a U-Boot boot loader, that I am accessing via serial UART. The ARM Linux kernel that loads identifies the device as having an ARM926EJ-S ...
3
votes
2answers
427 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
0
votes
1answer
89 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
1
vote
1answer
227 views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
3
votes
0answers
597 views

Using QEMU to boot arm uImage kernel

I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
1
vote
1answer
555 views

Rebuilding a symbol table for a firmware binary

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem. The kernel is MIPS big endian. I loaded the kernel ...
0
votes
2answers
179 views

Is reverse engineering possible for old windows kernels? [closed]

I'm interesteing, why someone not reverse engineer old windows 3.1? In theory, win 3.1 have no kernel(because kernel is dos), it's simply window manager(such as x window on unix), so why i can't ...
0
votes
1answer
733 views

Windows XP kernel debugging

I'm trying to debug Windows XP's kernel with KD but every time I start the debugger,it seem to crash. Setup Windows 10 (host machine,running kd) Windows XP x86 SP3 VM (being debugged) I configured ...