Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [kernel-mode]

Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.

2
votes
2answers
70 views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
1
vote
1answer
42 views

Debug a windows service entry without windbg

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
0
votes
0answers
37 views

How to read a global variable declared in ntoskrnl.exe?

I found the following global variable in IDA declared in ntoskrnl.exe whose value I'd like to obtain (with image base set to 0): In a normal executable, I'd take a base address of it, add the offset ...
1
vote
1answer
77 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
3
votes
1answer
106 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
12
votes
3answers
402 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
4
votes
0answers
400 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
0
votes
0answers
55 views

Strip digital signature check mechanism from windows

I had hex-edited the Windows kernel binary c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. And i want to boot it. However i encounter 0xc0000428 error, saying Windows ...
1
vote
1answer
65 views

Cannot load driver to memory

I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other ...
1
vote
0answers
61 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
0
votes
1answer
312 views

[windbg]kd - sxe ld <dll> from a process context won't fire

I'm trying to stop at a specific module load from a kernel debugger inside a specific process context. What i do is to first set sxe ld [process-name] let's say calc.exe. Now, when I run calc it ...
1
vote
2answers
173 views

Is there a ProcMon style program for Kernel-Mode?

Is there any way to monitor kernel-mode code execution on Windows with a program like Process Monitor or is that something for WinDbg only?
0
votes
1answer
89 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
4
votes
1answer
491 views

How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?

I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
-1
votes
1answer
180 views

Addresses of dlls in Kernel Space

I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
3
votes
2answers
680 views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...
4
votes
3answers
574 views

Faster Kernel debugging for Windows

I am Kernel debugging in Windbg and it's slow , very slow stepping through. My current setup is using VMWARE and Windbg through a com port on the Virtual Machine. Is there a faster way to debug the ...
4
votes
2answers
139 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
9
votes
1answer
519 views

How does the Windows Native API communicate with the kernel?

The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
3
votes
1answer
133 views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
0
votes
1answer
92 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
1
vote
2answers
397 views

IOCTL Code for Windows driver

Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
1
vote
0answers
442 views

Symbols could not be loaded for win32k drivers

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
-1
votes
0answers
387 views

Allwinner Camera Reversing: Compiling V4L [closed]

I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset. It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
1
vote
0answers
154 views

How get a full memory dump of a running specific process from kernel mode by driver?

How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
3
votes
1answer
382 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
0
votes
1answer
485 views

How find address of specific pool allocated? [closed]

How find address of specific pool that allocated by specific tag e.g. address of pool that allocated by CM7 tag? thanks
3
votes
1answer
1k views

WinDBG. How to catch first-chance exceptions?

I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session. I have written simple example application called Exceptions.exe: int WINAPI WinMain(...
0
votes
4answers
935 views

Advice about first steps on reversing windows kernel

I'll appreciate if anyone can give me a couple advices regarding kernel debugging/reversing. For instance if i want to know how the heap manager works what should i look for ? I have no experience ...
-2
votes
1answer
448 views

How rootkits hide services on kernel mode? [closed]

How rootkits hide services on kernel mode? thanks
5
votes
1answer
559 views

Unable to break at DriverEntry of malicious Driver

I got a malicious kernel mode driver from VirusTotal. Now, I am trying to debug it using Windbg. Below are the details of the setup: Host OS: Win 7 Ultimate 64-bit, Windbg version 6.11.x, VMWare ...
2
votes
1answer
977 views

Kernel debugging between two virtual machines not working

i want to do kernel debugging on my vm from another vm. My setup is pretty simple, Debugged - VM: Windows XP SP3 x32 (To be debugged) Debugger - VM: Windows 7 SP1 x64 (With Windbg installed - the ...
1
vote
1answer
570 views

Memory segment in IDA - ARM kernel

I just loaded up an ARM kernel image into IDA. When I boot up the ARM kernel and inspect the kernel symbols, I can see the following :- / $ cat /proc/kallsyms | head -n 10 00000000 t __vectors_start ...
1
vote
1answer
385 views

how to find gsharedinfo from current memory?

How would you scann all sections mapped in the local memory context to find gsharedinfo? gsharedinfo is not exported from user32.dll on Windows server 2008 !!! I would be grateful if you could help ...
1
vote
2answers
399 views

Disassemble IOS Kernel Module from jailbroken device?

I have a jailbroken IOS8 device, with an A6X processor. I'd like to pull either the device's kernel or a specific module, and decrypt it to use with a compatible objdump. The IOS kernel modules do ...
1
vote
0answers
431 views

Why darwin kernel crashes on function call via lldb while debugging the process?

I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps: I'm re-running my ruby script (vagrant) which hangs: $ vagrant destroy -f &...
3
votes
1answer
558 views

VirtualKD + VBox > 4.3

Is it any way to connect VirtualKD 2.8 to VBox > 4.3. I googled it but the nearest result was VBOX_WITH_VIRTUALKD config flag and some change logs about stub/loader. OK, because of lack of ...
1
vote
1answer
401 views

Patch driver loading process [closed]

Introduction Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog ...
0
votes
1answer
635 views

Anti-kernelmode functions (specifically zwquerysysteminformation) [closed]

I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around ...
1
vote
1answer
206 views

How to find status and path of the specific module with C in the windows? [duplicate]

How to find status and path of the specific module with C in the windows? such as windbg lm (list loaded module) kd> lm m cdd start end module name 93ae0000 93afe000 cdd (...
4
votes
3answers
6k views

Kernel debugging - how to set breakpoint at DriverEntry?

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
0
votes
2answers
152 views

Determining the number of instructions executed by a driver

How can I measure the number of instructions a Windows (or Linux or XNU) kernel driver/module executed after, say, an IOCTL or a SYSCALL? My only ideas are the following: Using WinDBG or remote GDB, ...
1
vote
2answers
4k views

How does sysenter instruction in windows 7 work?

How does the sysenter instruction work? What instruction is called after sysenter? Is the next instruction saved in a register? mov edx,esp sysenter
4
votes
1answer
1k views

Detecting SSDT and inline hooks in kernel

I did a simple SSDT Hooks detector that iterates through all entries and checks if any address is outside the Kernel module. If so, I can even go back and using the syscall find out what function was ...
0
votes
0answers
110 views

Set up an interrupt handler at kernel mode

I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
1
vote
1answer
581 views

Kernel dealing with the section headers in an ELF

I recently read that the kernel and the dynamic loader mostly deal with the program header tables in an ELF file and that assemblers, compilers and linkers deal with the section header tables. The ...
1
vote
2answers
2k views

Ollydbg problem

When I run Ollydbg in my Windows7 (x32) using kernel mode in StrongOd Plugin it doesn't load correctly and log shows this error: Log data, item 0 Message=StartService Failed, err = 2 And when ...
3
votes
2answers
539 views

IDA - save work on kernel mode debugging

I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status". Is ...
-1
votes
1answer
341 views

Kernel Driver Execution Flow ( Faster Than IDA or BinNavi )

Is there any tool help my to draw kernel-mode execution flow graph (basic block based or function based) ? My exact problem is slow speed. To clear my question lets ask this way: Is there any fast ...
4
votes
3answers
2k views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...