Questions tagged [kernel-mode]
Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.
137
questions
3
votes
2
answers
315
views
Is iOS 15 kernel cache encrypted?
I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
CommunityBot
- 1
2
votes
1
answer
227
views
Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?
The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
1
vote
1
answer
410
views
Addresses of dlls in Kernel Space
I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
CommunityBot
- 1
0
votes
0
answers
56
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 10.9k
4
votes
0
answers
256
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 519
4
votes
1
answer
475
views
Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency
I need help with something very Windows/kernel-specific.
I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
- 11
6
votes
1
answer
1k
views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
CommunityBot
- 1
3
votes
1
answer
115
views
Linux Kernel for embedded platform - Available Sources but no configuration
I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
- 257
2
votes
0
answers
53
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 257
4
votes
0
answers
84
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
2
votes
3
answers
2k
views
How to find the address (offset) of specific driver function
I am reversing Capcom driver and in IDA I have this list of functions:
I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
CommunityBot
- 1
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 5
2
votes
0
answers
394
views
Windows kernel debugging using IDA & WinDbg
I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
- 151
3
votes
1
answer
419
views
What is data only exploitation?
I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
CommunityBot
- 1
4
votes
1
answer
171
views
How to debug cfg80211.ko
I have an Linux embedded device that I want to debug the cfg80211.ko
I have full root SSH on that device.
How can I debug cfg80211.ko?
CommunityBot
- 1
2
votes
1
answer
115
views
does arbitrary kernel read write from usermode count as a vulnerability if it requires admin
Does arbitrary kernel read write from usermode count as a vulnerability if it requires admin or is it fine since it requires admin?
- 10.9k
3
votes
0
answers
205
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
0
votes
1
answer
97
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
- 16.3k
1
vote
0
answers
58
views
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
- 11
4
votes
1
answer
2k
views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
1
vote
1
answer
353
views
recovering a process dump from a memory dump with WinDbg
I have a crash dump (memory.dmp), and I want to extract process (calc.exe) from it.
I tried:
!process 0 0 calc.exe
PROCESS ffffb501f8c23580 <-- this is the address
SessionId: 0 Cid: 035c ...
- 459
1
vote
1
answer
234
views
What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice
In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
- 10.9k
1
vote
5
answers
3k
views
Advice about first steps on reversing windows kernel
I'll appreciate if anyone can give me a couple advices regarding kernel debugging/reversing.
For instance if i want to know how the heap manager works what should i look for ?
I have no experience ...
- 1,130
2
votes
2
answers
800
views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
CommunityBot
- 1
0
votes
0
answers
224
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 519
3
votes
3
answers
854
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
- 49
1
vote
2
answers
708
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 16.3k
1
vote
1
answer
278
views
What does the instructions sequence call/cdqe/ret do?
I'm trying to reverse a Linux module. In the ioctl routine, I have the following sequence of instructions (generated by objdump -M intel -d test.ko):
3f9: 74 3b je 436 <...
- 16.3k
2
votes
0
answers
236
views
Finding (or building) a kernel for Huawei EchoLife EG8145V5
I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
- 121
1
vote
0
answers
117
views
Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly
I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login.
I get a prompt ...
- 1,130
2
votes
1
answer
2k
views
How to extract the kernel assembly code from a zImage?
here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
1
vote
1
answer
233
views
Run ntoskrnl.exe with qemu
We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu.
Also can .efi files ...
- 36.4k
1
vote
1
answer
160
views
Kernel debug two physical MacBook pro devices
I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?):
I'm trying to kernel debug a physical Macbook pro device.
When my setup ...
- 668
1
vote
1
answer
409
views
How can i check if i am running in ring 0 / ring 3 on x64 CPU
I have read it is possible to check ring level with bit 3 of CS register.
Is there another register which really contains ring value (2 bits)
- 10.9k
1
vote
1
answer
127
views
Radare2 - "/c pointer; offset" command not giving expected response to search instances of the same pair of similar instructions
I am trying to find an offset IOSURFACEROOTUSERCLIENT_VTAB from an iOS kext(IOSurface) using radare2 and there is a need to use the command "/c pointer; offset" as per the instructions in ...
- 4,912
1
vote
0
answers
242
views
On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?
I have reviewed several sources on this PTE type, including Windows internals and the following:
http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
- 295
0
votes
1
answer
130
views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
- 16.3k
0
votes
0
answers
61
views
exports kernel Windows for informations on hardware
Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
- 21
1
vote
0
answers
42
views
Load an IDB file when debugging kernel to get the function names in IDA?
I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files.
Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
- 176
2
votes
1
answer
2k
views
Rebuilding a symbol table for a firmware binary
I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem.
The kernel is MIPS big endian. I loaded the kernel ...
- 1
1
vote
1
answer
221
views
Windbg .thread command is useless?
The ".thread" command is used to change the thread context in Windows kernel debugging.
MSDN
But I encountered the below situation:
Execute the following two commands consecutively.
The ...
- 16.3k
1
vote
1
answer
62
views
What is the role of PAGE section in windows Drivers?
I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
- 10.9k
0
votes
1
answer
41
views
Why would just two bits of the SP be used here?
This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7.
; Registers used:
; - r3 : unsigned long argp
0000005c mov r1, ...
- 36.4k
1
vote
1
answer
644
views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
CommunityBot
- 1
0
votes
1
answer
176
views
Where is the IMCR defined in the docs?
I'm currently programming a x64 kernel and need to set the Apic mode to symmetric I/O Mode. The Multiprocessor Specification from Intel at Page 31 says that to enable this mode you have to write 01H ...
- 1,235
1
vote
1
answer
193
views
How to keep symbols when taking memory snapshot with IDA?
When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this?
for example this is ...
- 36.4k
0
votes
1
answer
177
views
How to resolve major function numbers to their name while reversing windows drivers?
I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to ...
- 9,178
2
votes
1
answer
888
views
WinDBG doesn't resolve function names when debugging kernel module
I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).
Here is a picture ...
- 16.3k
2
votes
1
answer
235
views
Linux keyboard driver windows reverse engineering
I have toshiba portege x30-f laptop with Fn keys not working under linux.
I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
CommunityBot
- 1
4
votes
1
answer
4k
views
extract zImage from MS-DOS executable
I have an aarch64 kernel image with the following magic number:
root@localhost:/# cat msImage|xxd -l4
00000000: 4d5a 0091 MZ..
root@localhost:/# file msImage
...
