Questions tagged [kernel]

Mostly used for explaining core components of an operating system.

9 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
390 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
2
votes
0answers
1k views

Using QEMU to boot arm uImage kernel

I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
1
vote
0answers
55 views

Windows or Linux x86 Scheduler instructions

I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels. I have read there is a kind of "timer" inside CPU. This timer gives "time slices" to each process. ...
1
vote
1answer
309 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1
vote
0answers
283 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
0
votes
3answers
47 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
0answers
31 views

Is there an event log to check when WinDbg kernel debugger fails to attach on OS load?

I'm using the latest WinDbg (Preview) to do kernel debugging on a Windows 10 client (v 1909) via a network connection in a VM. And I'm wondering if there's a log that the kernel debugger maintains? I ...
0
votes
1answer
78 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
0
votes
0answers
47 views

How large are privileges of linux kernel module?

I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...