Questions tagged [kernel-mode]

Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Processor breakpoint not triggers in write operation - WinDbg

Following a specific address, i can't see the content on that address because i am getting "??" on memory section, which isn't an issue because it's supposed to be an invalid address in the ...
deon cagadoes's user avatar
0 votes
0 answers
46 views

Debug Linux Kernel ARM64

I need to extract Initramfs from the kernel. The initramfs archive itself is encrypted and located inside the kernel. I couldn't extract the key. I thought to run the kernel in Qemu, connect with the ...
Ren's user avatar
  • 1
0 votes
0 answers
52 views

Windows kernel Dev

I'm writing a basic program that'd allow me to list the running processes on a windows system but by simply trying to go through the ActiveProcessLinks of the _EPROCESS structure.The problem I'm ...
Essole's user avatar
  • 1
0 votes
1 answer
347 views

How to extract kext's from kernelcache?

I want to play with reverse engineering the Apple Neural Engine driver, which is a kernel extensions (com.apple.driver.AppleH11ANEInterface). These used to be in /System/Library/Extensions/, but on my ...
juzna.cz's user avatar
  • 101
0 votes
0 answers
64 views

Is there a debugger for the entire x86 architecture?

When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process. I am ...
AirToTec's user avatar
4 votes
0 answers
112 views

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
2 votes
0 answers
63 views

Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)

Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
OneAndOnly's user avatar
4 votes
1 answer
652 views

Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency

I need help with something very Windows/kernel-specific. I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
SilverLPs's user avatar
3 votes
1 answer
143 views

Linux Kernel for embedded platform - Available Sources but no configuration

I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
KiralyCraft's user avatar
2 votes
0 answers
601 views

Windows kernel debugging using IDA & WinDbg

I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
millionmilesaway's user avatar
4 votes
0 answers
332 views

How to debug windows EFI modules during boot using IDA Pro's windbg?

I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
OneAndOnly's user avatar
3 votes
0 answers
232 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
user19819208's user avatar
0 votes
1 answer
109 views

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
user19819208's user avatar
1 vote
1 answer
450 views

recovering a process dump from a memory dump with WinDbg

I have a crash dump (memory.dmp), and I want to extract process (calc.exe) from it. I tried: !process 0 0 calc.exe PROCESS ffffb501f8c23580 <-- this is the address SessionId: 0 Cid: 035c ...
AK_'s user avatar
  • 153
0 votes
0 answers
264 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
OneAndOnly's user avatar
3 votes
3 answers
1k views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
Ballers's user avatar
  • 49
1 vote
2 answers
818 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
Alexey's user avatar
  • 69
3 votes
2 answers
882 views

Windows - syscalls being called in a strange way?

I've been reading about the way syscalls are called in windows. The general theme in all the articles I read is: 64bit- called inside ntdll 32bit- from ntdll jumping to KiFastSystemcall but when I ...
Alal Benben's user avatar
1 vote
0 answers
137 views

Windows or Linux x86 Scheduler instructions

I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels. I have read there is a kind of "timer" inside CPU. This timer gives "time slices" to each process. ...
Bob5421's user avatar
  • 797
1 vote
1 answer
450 views

How can i check if i am running in ring 0 / ring 3 on x64 CPU

I have read it is possible to check ring level with bit 3 of CS register. Is there another register which really contains ring value (2 bits)
Bob5421's user avatar
  • 797
2 votes
1 answer
258 views

Why base address of GDT(global descriptor table) differ in intel x64 processor?

I have created a simple linux kernel module to get the base address of GDT table: #include <linux/init.h> #include <linux/module.h> #include <linux/const.h> #include <linux/errno....
shubham0d's user avatar
2 votes
1 answer
783 views

Get NonPagedPool (NPP) Base Address on any Windows OS

Is there a way to get the the base(start) address of the NonPagedPool in Windows ? I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
Ihab's user avatar
  • 131
-1 votes
1 answer
196 views

How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
Daniel Cohen's user avatar
1 vote
0 answers
64 views

How large are privileges of linux kernel module?

I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...
M. Kalter's user avatar
1 vote
1 answer
679 views

Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt

My setup: Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001 Debuggee: Win7 Pro (running in a VM using VMWare Workstation) I'm trying to follow the SendMessage call from the user space: Into the ...
c00000fd's user avatar
  • 1,659
1 vote
1 answer
296 views

Find address of kernel function

Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I ...
Rob Gates's user avatar
  • 131
1 vote
0 answers
655 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
moccajoghurt's user avatar
9 votes
2 answers
7k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc near ...
Biswapriyo's user avatar
  • 1,569
4 votes
1 answer
2k views

Debug a windows service entry without windbg

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
Twifty's user avatar
  • 422
1 vote
1 answer
1k views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
anx199's user avatar
  • 175
4 votes
1 answer
1k views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
c00000fd's user avatar
  • 1,659
12 votes
3 answers
985 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
MikeF's user avatar
  • 221
6 votes
1 answer
1k views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
c00000fd's user avatar
  • 1,659
1 vote
1 answer
145 views

Cannot load driver to memory

I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other ...
spimley's user avatar
  • 15
3 votes
0 answers
527 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
igor's user avatar
  • 31
0 votes
1 answer
6k views

[windbg]kd - sxe ld <dll> from a process context won't fire

I'm trying to stop at a specific module load from a kernel debugger inside a specific process context. What i do is to first set sxe ld [process-name] let's say calc.exe. Now, when I run calc it ...
Jimmy's user avatar
  • 3
2 votes
2 answers
2k views

Is there a ProcMon style program for Kernel-Mode?

Is there any way to monitor kernel-mode code execution on Windows with a program like Process Monitor or is that something for WinDbg only?
the_endian's user avatar
  • 1,860
0 votes
1 answer
671 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
rustam Shirinov's user avatar
3 votes
1 answer
2k views

How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?

I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
c00000fd's user avatar
  • 1,659
1 vote
1 answer
428 views

Addresses of dlls in Kernel Space

I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
rustam Shirinov's user avatar
1 vote
2 answers
14k views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...
LUser's user avatar
  • 783
5 votes
3 answers
2k views

Faster Kernel debugging for Windows

I am Kernel debugging in Windbg and it's slow , very slow stepping through. My current setup is using VMWARE and Windbg through a com port on the Virtual Machine. Is there a faster way to debug the ...
LUser's user avatar
  • 783
4 votes
2 answers
648 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
Joschi's user avatar
  • 43
9 votes
1 answer
2k views

How does the Windows Native API communicate with the kernel?

The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
the_endian's user avatar
  • 1,860
3 votes
1 answer
1k views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
the_endian's user avatar
  • 1,860
0 votes
1 answer
193 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
user20825's user avatar
3 votes
2 answers
3k views

IOCTL Code for Windows driver

Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
B. Bot's user avatar
  • 33
1 vote
0 answers
1k views

Symbols could not be loaded for win32k drivers

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
Vlad's user avatar
  • 153
-1 votes
0 answers
664 views

Allwinner Camera Reversing: Compiling V4L [closed]

I've reverse engineered quite a bit of action cameras based on Allwinner's poorly documented chipset. It runs firmware closely related to H3, in fact I can compile a kernel that boots with no video ...
gamut's user avatar
  • 1
1 vote
0 answers
265 views

How get a full memory dump of a running specific process from kernel mode by driver?

How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
forbiddenhi's user avatar