Questions tagged [kernel]

Mostly used for explaining core components of an operating system.

17 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
35 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
2
votes
2answers
440 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
2
votes
0answers
414 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
2
votes
0answers
2k views

Using QEMU to boot arm uImage kernel

I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the ...
1
vote
0answers
30 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
1
vote
0answers
23 views

On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?

I have reviewed several sources on this PTE type, including Windows internals and the following: http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
1
vote
0answers
74 views

Windows or Linux x86 Scheduler instructions

I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels. I have read there is a kind of "timer" inside CPU. This timer gives "time slices" to each process. ...
1
vote
0answers
358 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
0
votes
0answers
40 views

viewing debugging symbols in windbg

I am currently learning Malware Analysis using the book "Practical Malware Analysis", and I am going along with the chapter on Kernel debugging. When viewing the same code snippet on WinDbg ...
0
votes
0answers
35 views

Debugging kernel modul with IDA

I have shell at linux-arm-embedded and running gdb-server, There is kernel module(ko) that I want to debugging . How can I do that with IDA ?
0
votes
0answers
38 views

exports kernel Windows for informations on hardware

Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
0
votes
0answers
81 views

How do I debug Linux kernel modules with IDA?

I'm trying to figure out a workflow for analyzing Linux kernel modules. I want to debug the modules and not just view the disassembly, so I came upon this guide for IDA pro: https://www.hex-rays.com/...
0
votes
0answers
16 views

Load an IDB file when debugging kernel to get the function names in IDA?

I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files. Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
0
votes
0answers
28 views

How to pause a kernel debugee instead of stopping in IDA pro?

While debugging windows kernel with IDA, the problem is i cannot pause it like Windbg, when its running and i click on suspend, 50% of times it just freezes/crashes, and other times it just gets stuck ...
0
votes
0answers
83 views

IDA is already trying to suspend the process crash when debugging kernel?

Unlike Windbg where you can easily stop, in IDA when i want to pause the debugee and click on suspend, IDA says "IDA is already trying to suspend the process" then most of the times it ...
0
votes
3answers
246 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
0answers
52 views

How large are privileges of linux kernel module?

I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...