15
I found the solution. Double click the variable name (configSpaceBuffer in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array.
Here is the output after this change:
_this->ConfigSpace1 = configSpaceBuffer[1];
_this->ConfigSpace0 = configSpaceBuffer[0];
...
8
An alternative to patching the DriverInit function with an INT3 is to put a breakpoint in the IopLoadDriver function which is responsible for calling DriverInit. On Windows XP SP3, the breakpoint should be added at IopLoadDriver+0x66a which is call dword ptr [edi+2Ch] (0x2C is _DRIVER_OBJECT.DriverInit).
Find IopLoadDriver with x nt!IopLoadDriver
Add a ...
7
View->Open subviews->Type Libraries (Shift-F11), right click, Load Type Library..., wdk8_km.
6
nt!IopLoadDriver indirect call is used only for SERVICE_DEMAND start driver entry
for boot loading drivers you would need to break on nt!IopInitializeBuiltInDriver indirect call as well
you can see a short example on message #17 & #18 in this link
http://www.osronline.com/showthread.cfm?link=231280
this is a dormant script (slightly edited to use gc ...
6
I created a free driver for my Brother printer, available at github.com/pdewacht/brlaser. It's known to work with the Brother DCP-7030 and DCP-7065DN. If anybody tries it, I'd like to hear your feedback, it'd be useful to know which printers work with this driver and which printers don't.
5
Create an empty file, include whatever headers you want, add a DriverEntry and compile with debug symbols enabled and no optimization. Now load the test driver into IDA. If done correctly, All types should be available.
You should be able to export all types via File->Produce File->Dump typeinfo to IDC file... then load the script back File->Script ...
5
you can try breaking on driver load instead on just the entry:
sxe ld drv.sys
This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else fails.
5
The way CUPS works under the hood is it ends up executing a program (the binary driver) that operates on stdin. This binary must conform to the CUPS backed interface described quite comprehensively: http://www.cups.org/documentation.php/api-filter.html
Everything else provided by the driver is just scripts and meta-data (well, who knows, but the backend ...
5
VirtualQueryEx() is the way to go if you want a memory map of a target process.
However, if you want information about modules only, you can extract it from the PEB of the target process.
Get the PEB address using NtQueryInformationProcess, using ProcessBasicInformation for the ProcessInformationClass, so it writes a PROCESS_BASIC_INFORMATION. This ...
3
/**
\todo Get system info in loop. If the list grows between the first & 2nd call the allocd ammount may be too low
*/
BOOL GetKernelInformation(PSYSTEM_MODULE_INFORMATION* pModuleList)
{
NTSTATUS status = STATUS_SUCCESS;
ULONG neededSize = 0;
NtQuerySystemInformation(
SystemModuleInformation,
&neededSize,
0,
...
3
VMware exposes a GDB stub specifically for this purpose. Using this stub, one can connect GDB (or any GDB front-end) to manipulate the guest OS, as if it were a process.
VMware - OSDev Wiki
Debugging Windows kernel under VMWare using
IDA's GDB debugger - HexRays
3
edit
i didn't realize you are asking for immunity the answer is for plain straight ollydbg 1.10 the concept should be similar in immunity
you need to edit the IMAGE_SUBSYSTEM from IMAGE_SUBSYSTEM_NATIVE to IMAGE_SUBSYSTEM_WINDOWS_GUI or _CUI
ollydbg will now be able to load the driver (imports from hal etc will not be resolved but you can see the correct ...
3
Those are 16-bit USB keyboard/Keypad scan codes. Please see Keyboard Scan Code Specification for details. Appendix C contains the complete mapping
2
The file appears to be a binary-serialized .NET file (similar in concept to a Python pickle or a Java serialized stream), and does not appear to be obfuscated in any way. I manually parsed the first few records using the reference from Microsoft's stream format specification, and the format checks out. The file stores a single object of type "Extron....
2
You seem to be looking for the drivers' source code: http://welcome.solutions.brother.com/bsc/public_s/id/linux/en/download_src.html
2
Hum ...
Reverse engineering such a large piece of software will require a lot of will, time, and, of course, technical knowledge.
Honestly, unless you're considering starting a company or providing an open source/free software version of the driver, you'll be practically wasting your time. Especially if it is for a science project.
You must keep in mind ...
2
patch the Address of Entry Point with a (0xcc aka int 3) and load the driver AddrOfEntryPoint normally points to either DriverEntry or GsDriverEntry
when broken you need to replace 0xcc by original byte and reset eip back by a byte
use eb <address> originalbyte enter
r eip = <addresss>
here is the entry point of beep.sys which points to ...
2
To read with readelf the parameter is "-s":
Options are:
-a --all Equivalent to: -h -l -S -s -r -d -V -A -I
-h --file-header Display the ELF file header
-l --program-headers Display the program headers
--segments An alias for --program-headers
-S --section-headers Display the sections' header
-...
2
The Interlocked API may be what you are looking for. Or more generally, here is the MSDN topic on synchronization.
2
The allocation for most executive objects (like semaphores) is done inside the ObCreateObject() function. As you can see in ObCreateObject()'s prototype, one of the parameters is ObjectSizeToAllocate.
When a function like NtCreateSemaphore() is called, it calls ObCreateObject() with the size of the kernel object to be created (for example, sizeof(KSEMAPHORE)...
2
rootkit in kernel operate at the same security level as the operating system itself.
A rootkit can modify data structures in the Windows kernel using a method known as direct kernel object manipulation (DKOM)
This method can be used to hide processes. A kernel mode rootkit can also hook the System Service Descriptor Table (SSDT), or modify the gates between ...
2
Yes, you would need to patch ci.dll (which contains the list of hardcoded Root CAs) and winload.exe (which validates the integrity of ci.dll).
You can find this discussed in http://www.programdevelop.com/4608016/.
2
I've written an IDAPython script that searches for a string in the bytes preceding MmGetSystemRoutineAddress and FltGetRoutineAddress calls and then marks that call with the function being imported. It worked on the x64 and x86 drivers I had to hand but I've left my commented out debug prints in just in case.
Here's an example of the disassembly after ...
2
IDA comments list case values in decimal, so you need to either use 2237134 as decimal in your code, or convert it to hex (i.e. 0x2222CE) first.
Additional issue is that the value 0x2222CE is the full IOCTL code while the CTL_CODE macro accepts a function value (bits 2:12 of the code).
Using Online IOCTL decoder, we can see that the function is 0x8b3.
So ...
2
you can use a python script to find all the IOCTL codes in your binary, here is a script created for the very same purpose :
# Find the IoControlCodes corresponding to
# calls to DeviceIOControl within a binary
from idaapi import *
from idautils import *
from idc import *
##########################################################
# This class ...
2
I have used /dev/ptmx for that purpose:
Say i want to intercept data written to /dev/somedevice
First i open the master: /dev/ptmx.
Then i allocate a slave by calling ptsname.
Now rename /dev/somedevice to /dev/somedevice.orig
Symlink /dev/somedevice to the pts slave.
open the original device /dev/somedevice.orig
start copying data between the master and ...
2
Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a DLL. If that were not the case you'd be looking for a .sys file of some kind.
Microsoft has come up with a number of "simplified" driver models over the years....
2
It is possible. Take a minute to read the output from analyze. There's a few fields that will tell you what driver faulted like "FAULTING_MODULE", "IMAGE_NAME", and "MODULE_NAME".
It will give you the state of the registers as well and specifically what instruction that caused the crash so you'll see something like
driver + offset:
addresss: instruction
...
1
DTD Calculator (http://www.avsforum.com/forum/26-home-theater-computers/947830-custom-resolution-tool-intel-graphics-easier-overscan-correction.html) did the job for me.
Using it I was able to create valid EDIDs and add them to by modifying [NonEDIDMode_AddSwSettings] category in the said inf file(simply modify total number of DTD and add your EDID, do not ...
1
There are some possible reasons for that behavior.
As @tmr232 wrote you probably do not see an existing file because it is hidden. In this case enable "show hidden files" option in your file explorer.
The file is created before the use and deleted after it. In this case I'd suggest to use one of 2 options: either try to run a script that always tries to ...
Only top voted, non community-wiki answers of a minimum length are eligible