Questions tagged [kernel-mode]
Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.
80
questions
0
votes
0
answers
56
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 3
4
votes
0
answers
83
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
2
votes
0
answers
53
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 519
4
votes
1
answer
471
views
Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency
I need help with something very Windows/kernel-specific.
I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
- 41
3
votes
1
answer
115
views
Linux Kernel for embedded platform - Available Sources but no configuration
I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
- 31
2
votes
0
answers
387
views
Windows kernel debugging using IDA & WinDbg
I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
- 151
4
votes
0
answers
254
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 519
3
votes
0
answers
203
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
0
votes
1
answer
97
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
- 33
1
vote
1
answer
351
views
recovering a process dump from a memory dump with WinDbg
I have a crash dump (memory.dmp), and I want to extract process (calc.exe) from it.
I tried:
!process 0 0 calc.exe
PROCESS ffffb501f8c23580 <-- this is the address
SessionId: 0 Cid: 035c ...
- 153
0
votes
0
answers
222
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 519
3
votes
3
answers
847
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
- 49
1
vote
2
answers
702
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 69
3
votes
2
answers
805
views
Windows - syscalls being called in a strange way?
I've been reading about the way syscalls are called in windows.
The general theme in all the articles I read is:
64bit- called inside ntdll
32bit- from ntdll jumping to KiFastSystemcall
but when I ...
- 33
1
vote
0
answers
127
views
Windows or Linux x86 Scheduler instructions
I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels.
I have read there is a kind of "timer" inside CPU. This timer gives "time slices" to each process.
...
- 797
1
vote
1
answer
409
views
How can i check if i am running in ring 0 / ring 3 on x64 CPU
I have read it is possible to check ring level with bit 3 of CS register.
Is there another register which really contains ring value (2 bits)
- 797
2
votes
1
answer
249
views
Why base address of GDT(global descriptor table) differ in intel x64 processor?
I have created a simple linux kernel module to get the base address of GDT table:
#include <linux/init.h>
#include <linux/module.h>
#include <linux/const.h>
#include <linux/errno....
- 51
2
votes
1
answer
721
views
Get NonPagedPool (NPP) Base Address on any Windows OS
Is there a way to get the the base(start) address of the NonPagedPool in Windows ?
I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
- 131
-1
votes
1
answer
188
views
How to find each interrupt's line in the Interrupt Descriptor Table
I'm trying to find the line number of the 0f05 syscall interrupt with no success.
I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
1
vote
0
answers
64
views
How large are privileges of linux kernel module?
I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...
- 55
1
vote
1
answer
609
views
Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt
My setup:
Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
Debuggee: Win7 Pro (running in a VM using VMWare Workstation)
I'm trying to follow the SendMessage call from the user space:
Into the ...
- 1,639
1
vote
1
answer
285
views
Find address of kernel function
Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I ...
- 131
1
vote
0
answers
527
views
Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)
In the core my question is about how to reverse engineer undocumented functions.
I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
- 11
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,559
4
votes
1
answer
2k
views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
- 422
1
vote
1
answer
1k
views
Game's anti-cheat complains when driver test-signing mode is on
I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode.
My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
- 175
4
votes
1
answer
1k
views
Question about the limit and base address in x86-64 segmentation model?
I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it.
So I was reviewing the ...
- 1,639
12
votes
3
answers
945
views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
- 221
6
votes
1
answer
1k
views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
- 1,639
1
vote
1
answer
143
views
Cannot load driver to memory
I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other ...
- 15
3
votes
0
answers
492
views
Cannot debug some drivers with IDA
For some drivers I can use the following WinDBG command:
bu driver!DriverEntry
However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
- 31
0
votes
1
answer
5k
views
[windbg]kd - sxe ld <dll> from a process context won't fire
I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.
What i do is to first set sxe ld [process-name] let's say calc.exe.
Now, when I run calc it ...
- 3
2
votes
2
answers
2k
views
Is there a ProcMon style program for Kernel-Mode?
Is there any way to monitor kernel-mode code execution on Windows with a program like Process Monitor or is that something for WinDbg only?
- 1,830
0
votes
1
answer
651
views
TOKEN structure in Kernel
I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code.
...
- 395
3
votes
1
answer
2k
views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
- 1,639
1
vote
1
answer
410
views
Addresses of dlls in Kernel Space
I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
- 395
1
vote
2
answers
14k
views
How can I receive DbgPrint messages in windbg on windows 10
I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for.
I am ...
- 773
5
votes
3
answers
2k
views
Faster Kernel debugging for Windows
I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the ...
- 773
4
votes
2
answers
640
views
Kernel debug - internet explorer in kernelmode?
My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).
So I get the process list with !process, one active process is Internet Explorer:
...
- 43
8
votes
1
answer
2k
views
How does the Windows Native API communicate with the kernel?
The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
- 1,830
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,830
0
votes
1
answer
191
views
Detecting user<->kernel transitions with hypervisor
Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
3
votes
2
answers
3k
views
IOCTL Code for Windows driver
Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
- 33
1
vote
0
answers
1k
views
Symbols could not be loaded for win32k drivers
I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
- 153
-1
votes
0
answers
657
views
Allwinner Camera Reversing: Compiling V4L [closed]
I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset.
It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
- 1
1
vote
0
answers
261
views
How get a full memory dump of a running specific process from kernel mode by driver?
How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
- 121
3
votes
1
answer
607
views
Do all drivers exist in Kernel mode?
I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question.
After reading a section of 'Practical Malware Analysis' discussing the ...
user15338
0
votes
1
answer
2k
views
How find address of specific pool allocated? [closed]
How find address of specific pool that allocated by specific tag
e.g. address of pool that allocated by CM7 tag?
thanks
- 121
3
votes
1
answer
4k
views
WinDBG. How to catch first-chance exceptions?
I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session.
I have written simple example application called Exceptions.exe:
int WINAPI WinMain(...
- 33
1
vote
5
answers
3k
views
Advice about first steps on reversing windows kernel
I'll appreciate if anyone can give me a couple advices regarding kernel debugging/reversing.
For instance if i want to know how the heap manager works what should i look for ?
I have no experience ...
- 21