Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [kernel]

Mostly used for explaining core components of an operating system.

0
votes
0answers
38 views

Load custom kernel from firmware on QEMU

I would like to do dynamic analysis for some Linux kernel found in some firmware iv'e fetched from the internet. The kernel image is ARM based. How can I load this kernel image on qemu? Should i ...
3
votes
1answer
70 views

Questions about enabling special pool on win32k

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10 Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
0
votes
0answers
62 views

windows kernel mode exceptions not caught in windbg

I've done a few tests and it seems WinDbg does not catch some exceptions triggered inside a __try/__except clause in kernel mode. The code I run in kernel mode is as follows __try { /* code ...
1
vote
0answers
45 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
0
votes
0answers
45 views

How to read a global variable declared in ntoskrnl.exe?

I found the following global variable in IDA declared in ntoskrnl.exe whose value I'd like to obtain (with image base set to 0): In a normal executable, I'd take a base address of it, add the offset ...
2
votes
1answer
152 views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...
12
votes
3answers
459 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
2
votes
1answer
79 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
2
votes
2answers
399 views

How does QPST work and how can I make an app like it?

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(...
2
votes
1answer
101 views

Windows x86 compability on x64 operating system

I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
1
vote
0answers
182 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
0
votes
0answers
64 views

Finding process offsets

I'm looking to find Offsets for Windows processes to hook in to and change in memory. What's the quickest way to go about this? I tried cheatengine, but unfortunately returns too many results to be ...
1
vote
1answer
59 views

HighWaterNumberOfObjects/Handles meaning?

I've been looking at some kernel debugging and came to see this: 0: kd> dt nt!_OBJECT_TYPE ffffd0851aad6c90 +0x000 TypeList : _LIST_ENTRY [ 0xffffd085`1aad6c90 - 0xffffd085`1aad6c90 ] ...
0
votes
0answers
79 views

Kernel Debugging With Virtualbox on Linux host (ERROR: Win32 error 0n2)

I have a problem with my kernel debugging setup. First of all, I have the following VM configurations: Host: Linux 17.04 (x64) Debugger VM: Win 7 SP1 (x32) with Guest additions installed + WinDBG ...
6
votes
2answers
343 views

Getting the current process in Windows

While reading Practical Reverse Engineering by Bruce Dang, I came across the following. Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
4
votes
2answers
186 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
0
votes
0answers
194 views

Help identifying unknown boot console UART ARM CPU before U-Boot bootloader and/or read flash image?

I have an embedded Linux device with flash storage, using a U-Boot boot loader, that I am accessing via serial UART. The ARM Linux kernel that loads identifies the device as having an ARM926EJ-S ...
3
votes
2answers
616 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
0
votes
1answer
106 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
1
vote
1answer
269 views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
3
votes
0answers
737 views

Using QEMU to boot arm uImage kernel

I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
1
vote
1answer
677 views

Rebuilding a symbol table for a firmware binary

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem. The kernel is MIPS big endian. I loaded the kernel ...
0
votes
2answers
235 views

Is reverse engineering possible for old windows kernels? [closed]

I'm interesteing, why someone not reverse engineer old windows 3.1? In theory, win 3.1 have no kernel(because kernel is dos), it's simply window manager(such as x window on unix), so why i can't ...
0
votes
1answer
820 views

Windows XP kernel debugging

I'm trying to debug Windows XP's kernel with KD but every time I start the debugger,it seem to crash. Setup Windows 10 (host machine,running kd) Windows XP x86 SP3 VM (being debugged) I configured ...