Questions tagged [kernel-mode]
Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.
28
questions with no upvoted or accepted answers
4
votes
0
answers
83
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
4
votes
0
answers
254
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 519
3
votes
0
answers
203
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
3
votes
2
answers
314
views
Is iOS 15 kernel cache encrypted?
I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user41084
3
votes
0
answers
492
views
Cannot debug some drivers with IDA
For some drivers I can use the following WinDBG command:
bu driver!DriverEntry
However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
- 31
2
votes
0
answers
53
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 519
2
votes
0
answers
387
views
Windows kernel debugging using IDA & WinDbg
I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
- 151
2
votes
0
answers
233
views
Finding (or building) a kernel for Huawei EchoLife EG8145V5
I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
- 121
2
votes
0
answers
498
views
IDA Pro macOS kernel debugging and lldb support
I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
2
votes
0
answers
2k
views
Using QEMU to boot arm uImage kernel
I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
- 21
1
vote
0
answers
58
views
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
- 11
1
vote
0
answers
117
views
Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly
I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login.
I get a prompt ...
- 263
1
vote
0
answers
241
views
On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?
I have reviewed several sources on this PTE type, including Windows internals and the following:
http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
- 295
1
vote
0
answers
42
views
Load an IDB file when debugging kernel to get the function names in IDA?
I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files.
Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
- 176
1
vote
0
answers
127
views
Windows or Linux x86 Scheduler instructions
I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels.
I have read there is a kind of "timer" inside CPU. This timer gives "time slices" to each process.
...
- 797
1
vote
0
answers
64
views
How large are privileges of linux kernel module?
I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...
- 55
1
vote
0
answers
527
views
Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)
In the core my question is about how to reverse engineer undocumented functions.
I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
- 11
1
vote
1
answer
410
views
Addresses of dlls in Kernel Space
I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
- 395
1
vote
0
answers
1k
views
Symbols could not be loaded for win32k drivers
I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
- 153
1
vote
0
answers
261
views
How get a full memory dump of a running specific process from kernel mode by driver?
How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
- 121
1
vote
0
answers
581
views
Why darwin kernel crashes on function call via lldb while debugging the process?
I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps:
I'm re-running my ruby script (vagrant) which hangs:
$ vagrant destroy -f &...
- 465
0
votes
0
answers
56
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 3
0
votes
0
answers
222
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 519
0
votes
0
answers
61
views
exports kernel Windows for informations on hardware
Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
- 21
0
votes
0
answers
131
views
Set up an interrupt handler at kernel mode
I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
- 101