Questions tagged [kernel-mode]
Unix memory model relies on a strong separation between user-space memory and kernel-space memory. This tag refers to mechanisms that lie in kernel-space.
137
questions
16
votes
1
answer
3k
views
Malware Hooking INT 1 and INT 3
I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
- 4,056
12
votes
3
answers
945
views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
- 221
11
votes
1
answer
2k
views
Kernel level Dynamic Binary Instrumentation
Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
- 4,470
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,559
8
votes
1
answer
2k
views
How does the Windows Native API communicate with the kernel?
The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
- 1,830
8
votes
1
answer
8k
views
WinDbg fails to connect to IDA Pro debugger server
Environment:
Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg
Guest: Win7 SP1 x64
I have VirtualKD setup correctly in my guest and host.
I say this because ...
8
votes
2
answers
2k
views
Getting the current process in Windows
While reading Practical Reverse Engineering by Bruce Dang, I came across the following.
Am I correct in my assumption that the procedures return a pointer to the current thread and current process ...
- 183
6
votes
1
answer
1k
views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
- 1,639
5
votes
2
answers
4k
views
how to reverse DeviceIoControl?
I have started reversing this piece of malware. At some point it creates a service and starts it, then immediately it calls the function DeviceIoControl and the malware went from "paused" to "running" ...
- 95
5
votes
3
answers
2k
views
Faster Kernel debugging for Windows
I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the ...
- 773
5
votes
3
answers
3k
views
How to break on not-yet-loaded kernel driver
I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
- 413
5
votes
3
answers
12k
views
Kernel debugging - how to set breakpoint at DriverEntry?
I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
- 53
5
votes
1
answer
2k
views
Using a VMM/hypervisor to monitor guest OS execution?
I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
- 53
4
votes
2
answers
2k
views
Find the kernel structure that contains device name
I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the _DRIVER_OBJECT structure. Unfortunately, the _DEVICE_OBJECT does not ...
- 323
4
votes
1
answer
2k
views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
- 422
4
votes
1
answer
1k
views
Unable to break at DriverEntry of malicious Driver
I got a malicious kernel mode driver from VirusTotal. Now, I am trying to debug it using Windbg.
Below are the details of the setup:
Host OS: Win 7 Ultimate 64-bit, Windbg version 6.11.x, VMWare ...
- 765
4
votes
2
answers
1k
views
How does Kernel Detective check if API functions are hooked?
One of the many features of Kernel Detective is the possibility to retrieve the original addresses of the native apis functions implemented in the driver win32k.sys and checking if they are hooked. ...
- 95
4
votes
1
answer
534
views
ntoskrnl checksum mismatch
I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it.
System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
- 143
4
votes
1
answer
4k
views
extract zImage from MS-DOS executable
I have an aarch64 kernel image with the following magic number:
root@localhost:/# cat msImage|xxd -l4
00000000: 4d5a 0091 MZ..
root@localhost:/# file msImage
...
- 141
4
votes
2
answers
640
views
Kernel debug - internet explorer in kernelmode?
My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).
So I get the process list with !process, one active process is Internet Explorer:
...
- 43
4
votes
1
answer
2k
views
Detecting SSDT and inline hooks in kernel
I did a simple SSDT Hooks detector that iterates through all entries and checks if any address is outside the Kernel module. If so, I can even go back and using the syscall find out what function was ...
- 317
4
votes
1
answer
1k
views
Question about the limit and base address in x86-64 segmentation model?
I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it.
So I was reviewing the ...
- 1,639
4
votes
1
answer
471
views
Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency
I need help with something very Windows/kernel-specific.
I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
- 41
4
votes
1
answer
171
views
How to debug cfg80211.ko
I have an Linux embedded device that I want to debug the cfg80211.ko
I have full root SSH on that device.
How can I debug cfg80211.ko?
- 281
4
votes
0
answers
83
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
4
votes
0
answers
254
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 519
3
votes
2
answers
6k
views
How does sysenter instruction in windows 7 work?
How does the sysenter instruction work?
What instruction is called after sysenter?
Is the next instruction saved in a register?
mov edx,esp
sysenter
- 41
3
votes
1
answer
607
views
Do all drivers exist in Kernel mode?
I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question.
After reading a section of 'Practical Malware Analysis' discussing the ...
user15338
3
votes
3
answers
1k
views
_DEVOBJ_EXTENSION structure information
I'm looking for information on the _DEVICE_OBJECT->_DEVOBJ_EXTENSION structure.
I'd like to know a bit more about this structure in genernal, like what it's actually used for. But specifically, I'd ...
- 323
3
votes
2
answers
805
views
Windows - syscalls being called in a strange way?
I've been reading about the way syscalls are called in windows.
The general theme in all the articles I read is:
64bit- called inside ntdll
32bit- from ntdll jumping to KiFastSystemcall
but when I ...
- 33
3
votes
2
answers
3k
views
windbg - Why does the GS register resolve to offset 0x0?
I'm trying to understand how to resolve segment addressing (specifically the GS register in X64).
My toy program:
int main()
{
unsigned long long x;
__debugbreak();
x = __readgsqword(...
- 145
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
3
votes
2
answers
3k
views
IOCTL Code for Windows driver
Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
- 33
3
votes
3
answers
847
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
- 49
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,830
3
votes
1
answer
4k
views
WinDBG. How to catch first-chance exceptions?
I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session.
I have written simple example application called Exceptions.exe:
int WINAPI WinMain(...
- 33
3
votes
1
answer
1k
views
How to use windbg to view assembly code of kernel function?
I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
- 31
3
votes
1
answer
2k
views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
- 1,639
3
votes
1
answer
2k
views
Kernel debugging between two virtual machines not working
i want to do kernel debugging on my vm from another vm.
My setup is pretty simple,
Debugged - VM:
Windows XP SP3 x32 (To be debugged)
Debugger - VM:
Windows 7 SP1 x64 (With Windbg installed - the ...
- 668
3
votes
1
answer
784
views
VirtualKD + VBox > 4.3
Is it any way to connect VirtualKD 2.8 to VBox > 4.3.
I googled it but the nearest result was VBOX_WITH_VIRTUALKD config flag and some change logs about stub/loader.
OK, because of lack of ...
- 108
3
votes
2
answers
844
views
IDA - save work on kernel mode debugging
I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status".
Is ...
- 65
3
votes
1
answer
115
views
Linux Kernel for embedded platform - Available Sources but no configuration
I am trying to recompile the kernel for the Redmi Note 4 (MTK). I have successfully obtained a copy of the stock, pre-compiled kernel, and a variant of sources that seems to coincide quite well with ...
- 31
3
votes
1
answer
407
views
What is data only exploitation?
I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
- 31
3
votes
0
answers
203
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
3
votes
2
answers
314
views
Is iOS 15 kernel cache encrypted?
I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user41084
3
votes
0
answers
492
views
Cannot debug some drivers with IDA
For some drivers I can use the following WinDBG command:
bu driver!DriverEntry
However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
- 31
3
votes
1
answer
430
views
Questions about enabling special pool on win32k
So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10
Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
- 329