Questions tagged [kernel]

Mostly used for explaining core components of an operating system.

0
votes
1answer
116 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
0answers
35 views

Log all syscalls inside a qemu vm

I am looking for a way to trace all syscalls which are triggered inside a qemu linux virtual machine. I have no strace command inside the linux vm Is there a way to do that ? Thanks
1
vote
2answers
114 views

windbg - Why does the GS register resolve to offset 0x0?

I'm trying to understand how to resolve segment addressing (specifically the GS register in X64). My toy program: int main() { unsigned long long x; __debugbreak(); x = __readgsqword(...
0
votes
0answers
27 views

windbg - What does the “Commit” column of the !vad command output mean?

[cross-posted (but closed the original) from https://stackoverflow.com/q/55438678/254959] As above, when I do a !vad in windbg, what do the values in under the Commit column mean? kd> !vad VAD ...
1
vote
1answer
45 views

windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?

[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959] I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
3
votes
1answer
85 views

How to use windbg to view assembly code of kernel function?

I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
1
vote
1answer
117 views

How to identify which iOS kernelcache is installed?

I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an ...
3
votes
1answer
114 views

Questions about enabling special pool on win32k

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10 Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
1
vote
0answers
126 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
2
votes
1answer
435 views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...
12
votes
3answers
549 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
3
votes
1answer
129 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
2
votes
2answers
771 views

How does QPST work and how can I make an app like it?

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(...
2
votes
1answer
109 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
1
vote
0answers
263 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
1
vote
1answer
63 views

HighWaterNumberOfObjects/Handles meaning?

I've been looking at some kernel debugging and came to see this: 0: kd> dt nt!_OBJECT_TYPE ffffd0851aad6c90 +0x000 TypeList : _LIST_ENTRY [ 0xffffd085`1aad6c90 - 0xffffd085`1aad6c90 ] ...
6
votes
2answers
504 views

Getting the current process in Windows

While reading Practical Reverse Engineering by Bruce Dang, I came across the following. Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
4
votes
2answers
248 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
3
votes
2answers
943 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
0
votes
1answer
127 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
1
vote
1answer
365 views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
2
votes
0answers
942 views

Using QEMU to boot arm uImage kernel

I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
1
vote
1answer
930 views

Rebuilding a symbol table for a firmware binary

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem. The kernel is MIPS big endian. I loaded the kernel ...
0
votes
2answers
319 views

Is reverse engineering possible for old windows kernels? [closed]

I'm interesteing, why someone not reverse engineer old windows 3.1? In theory, win 3.1 have no kernel(because kernel is dos), it's simply window manager(such as x window on unix), so why i can't ...
0
votes
1answer
1k views

Windows XP kernel debugging

I'm trying to debug Windows XP's kernel with KD but every time I start the debugger,it seem to crash. Setup Windows 10 (host machine,running kd) Windows XP x86 SP3 VM (being debugged) I configured ...