Questions tagged [kernel-mode]
Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.
9
questions
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,559
11
votes
1
answer
2k
views
Kernel level Dynamic Binary Instrumentation
Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
- 4,470
8
votes
1
answer
2k
views
How does the Windows Native API communicate with the kernel?
The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
- 1,830
4
votes
2
answers
1k
views
How does Kernel Detective check if API functions are hooked?
One of the many features of Kernel Detective is the possibility to retrieve the original addresses of the native apis functions implemented in the driver win32k.sys and checking if they are hooked. ...
- 95
3
votes
2
answers
3k
views
IOCTL Code for Windows driver
Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
- 33
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,830
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
2
votes
3
answers
2k
views
How to find the address (offset) of specific driver function
I am reversing Capcom driver and in IDA I have this list of functions:
I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
- 573
0
votes
1
answer
1k
views
Anti-kernelmode functions (specifically zwquerysysteminformation) [closed]
I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around ...
- 3