Skip to main content

Questions tagged [kernel-mode]

Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.

Filter by
Sorted by
Tagged with
16 votes
1 answer
3k views

Malware Hooking INT 1 and INT 3

I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
mrduclaw's user avatar
  • 4,066
12 votes
3 answers
1k views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
MikeF's user avatar
  • 221
11 votes
1 answer
2k views

Kernel level Dynamic Binary Instrumentation

Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
joxeankoret's user avatar
  • 4,488
9 votes
2 answers
7k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc near ...
Biswapriyo's user avatar
  • 1,569
9 votes
1 answer
2k views

How does the Windows Native API communicate with the kernel?

The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
the_endian's user avatar
  • 1,870
8 votes
1 answer
8k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...
Lelouch Lamperouge's user avatar
8 votes
2 answers
2k views

Getting the current process in Windows

While reading Practical Reverse Engineering by Bruce Dang, I came across the following. Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
Aswin P J's user avatar
  • 183
6 votes
1 answer
1k views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
c00000fd's user avatar
  • 1,711
5 votes
2 answers
4k views

how to reverse DeviceIoControl?

I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...
user4170's user avatar
5 votes
3 answers
2k views

Faster Kernel debugging for Windows

I am Kernel debugging in Windbg and it's slow , very slow stepping through. My current setup is using VMWARE and Windbg through a com port on the Virtual Machine. Is there a faster way to debug the ...
LUser's user avatar
  • 793
5 votes
3 answers
3k views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
Andrew's user avatar
  • 413
5 votes
3 answers
13k views

Kernel debugging - how to set breakpoint at DriverEntry?

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
user1680791's user avatar
5 votes
1 answer
2k views

Using a VMM/hypervisor to monitor guest OS execution?

I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
KeBugCheck's user avatar
4 votes
2 answers
3k views

Find the kernel structure that contains device name

I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the _DRIVER_OBJECT structure. Unfortunately, the _DEVICE_OBJECT does not ...
ben_re's user avatar
  • 323
4 votes
1 answer
3k views

Debug a windows service entry without windbg

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
Twifty's user avatar
  • 422
4 votes
1 answer
1k views

Unable to break at DriverEntry of malicious Driver

I got a malicious kernel mode driver from VirusTotal. Now, I am trying to debug it using Windbg. Below are the details of the setup: Host OS: Win 7 Ultimate 64-bit, Windbg version 6.11.x, VMWare ...
Neon Flash's user avatar
4 votes
2 answers
1k views

How does Kernel Detective check if API functions are hooked?

One of the many features of Kernel Detective is the possibility to retrieve the original addresses of the native apis functions implemented in the driver win32k.sys and checking if they are hooked. ...
user4170's user avatar
4 votes
1 answer
596 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
xakepp35's user avatar
  • 143
4 votes
1 answer
4k views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...
MOHAMMAD RASIM's user avatar
4 votes
2 answers
651 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
Joschi's user avatar
  • 43
4 votes
1 answer
2k views

Detecting SSDT and inline hooks in kernel

I did a simple SSDT Hooks detector that iterates through all entries and checks if any address is outside the Kernel module. If so, I can even go back and using the syscall find out what function was ...
user3002428's user avatar
4 votes
1 answer
1k views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
c00000fd's user avatar
  • 1,711
4 votes
1 answer
703 views

Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency

I need help with something very Windows/kernel-specific. I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
SilverLPs's user avatar
4 votes
1 answer
204 views

How to debug cfg80211.ko

I have an Linux embedded device that I want to debug the cfg80211.ko I have full root SSH on that device. How can I debug cfg80211.ko?
Kokomelom's user avatar
  • 281
4 votes
0 answers
118 views

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
4 votes
0 answers
348 views

How to debug windows EFI modules during boot using IDA Pro's windbg?

I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
OneAndOnly's user avatar
3 votes
2 answers
6k views

How does sysenter instruction in windows 7 work?

How does the sysenter instruction work? What instruction is called after sysenter? Is the next instruction saved in a register? mov edx,esp sysenter
user2522767's user avatar
3 votes
1 answer
627 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
user avatar
3 votes
3 answers
1k views

_DEVOBJ_EXTENSION structure information

I'm looking for information on the _DEVICE_OBJECT->_DEVOBJ_EXTENSION structure. I'd like to know a bit more about this structure in genernal, like what it's actually used for. But specifically, I'd ...
ben_re's user avatar
  • 323
3 votes
2 answers
900 views

Windows - syscalls being called in a strange way?

I've been reading about the way syscalls are called in windows. The general theme in all the articles I read is: 64bit- called inside ntdll 32bit- from ntdll jumping to KiFastSystemcall but when I ...
Alal Benben's user avatar
3 votes
2 answers
3k views

windbg - Why does the GS register resolve to offset 0x0?

I'm trying to understand how to resolve segment addressing (specifically the GS register in X64). My toy program: int main() { unsigned long long x; __debugbreak(); x = __readgsqword(...
Edwin Lee's user avatar
  • 145
3 votes
2 answers
2k views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
ResQue's user avatar
  • 51
3 votes
2 answers
3k views

IOCTL Code for Windows driver

Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
B. Bot's user avatar
  • 33
3 votes
3 answers
1k views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
Ballers's user avatar
  • 49
3 votes
1 answer
1k views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
the_endian's user avatar
  • 1,870
3 votes
1 answer
5k views

WinDBG. How to catch first-chance exceptions?

I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session. I have written simple example application called Exceptions.exe: int WINAPI WinMain(...
user15287's user avatar
3 votes
1 answer
1k views

How to use windbg to view assembly code of kernel function?

I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
Kyi Soe Thin's user avatar
3 votes
1 answer
2k views

How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?

I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
c00000fd's user avatar
  • 1,711
3 votes
1 answer
2k views

Kernel debugging between two virtual machines not working

i want to do kernel debugging on my vm from another vm. My setup is pretty simple, Debugged - VM: Windows XP SP3 x32 (To be debugged) Debugger - VM: Windows 7 SP1 x64 (With Windbg installed - the ...
0xAK's user avatar
  • 668
3 votes
1 answer
792 views

VirtualKD + VBox > 4.3

Is it any way to connect VirtualKD 2.8 to VBox > 4.3. I googled it but the nearest result was VBOX_WITH_VIRTUALKD config flag and some change logs about stub/loader. OK, because of lack of ...
diener_k's user avatar
  • 108
3 votes
2 answers
882 views

IDA - save work on kernel mode debugging

I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status". Is ...
user4559's user avatar
3 votes
1 answer
148 views

Linux Kernel for embedded platform - Available Sources but no configuration

I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
KiralyCraft's user avatar
3 votes
1 answer
651 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
one1one's user avatar
  • 31
3 votes
0 answers
244 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
user19819208's user avatar
3 votes
2 answers
373 views

Is iOS 15 kernel cache encrypted?

I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user avatar
3 votes
0 answers
541 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
igor's user avatar
  • 31
3 votes
1 answer
435 views

Questions about enabling special pool on win32k

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10 Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
Jaewon Min's user avatar