Hot answers tagged

7 votes
Accepted

How to import Windows DDK headers into IDA?

View->Open subviews->Type Libraries (Shift-F11), right click, Load Type Library..., wdk8_km.
user avatar
  • 34.7k
6 votes

Did somebody start to reverse engineer the proprietary Linux Brother Cups drivers?

I created a free driver for my Brother printer, available at github.com/pdewacht/brlaser. It's known to work with the Brother DCP-7030 and DCP-7065DN. If anybody tries it, I'd like to hear your ...
user avatar
  • 276
5 votes

Did somebody start to reverse engineer the proprietary Linux Brother Cups drivers?

The way CUPS works under the hood is it ends up executing a program (the binary driver) that operates on stdin. This binary must conform to the CUPS backed interface described quite comprehensively: ...
user avatar
  • 403
5 votes

Kernel debugging - how to set breakpoint at DriverEntry?

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else ...
user avatar
  • 34.7k
5 votes

How to import Windows DDK headers into IDA?

Create an empty file, include whatever headers you want, add a DriverEntry and compile with debug symbols enabled and no optimization. Now load the test driver into IDA. If done correctly, All types ...
user avatar
5 votes

How to find status and path of the specific module with C in the windows?

VirtualQueryEx() is the way to go if you want a memory map of a target process. However, if you want information about modules only, you can extract it from the PEB of the target process. Get the ...
user avatar
  • 578
3 votes
Accepted

Address of loaded driver on memory

/** \todo Get system info in loop. If the list grows between the first & 2nd call the allocd ammount may be too low */ BOOL GetKernelInformation(PSYSTEM_MODULE_INFORMATION* pModuleList) { ...
user avatar
  • 260
3 votes

Kernel debugging - how to set breakpoint at DriverEntry?

patch the Address of Entry Point with a (0xcc aka int 3) and load the driver AddrOfEntryPoint normally points to either DriverEntry or GsDriverEntry when broken you need to replace 0xcc by ...
user avatar
  • 14.9k
3 votes
Accepted

Does anyone recognize this keyboard encoding scheme?

Those are 16-bit USB keyboard/Keypad scan codes. Please see Keyboard Scan Code Specification for details. Appendix C contains the complete mapping
user avatar
2 votes
Accepted

Determine encrypted/hashed/compressed proprietary driver file

The file appears to be a binary-serialized .NET file (similar in concept to a Python pickle or a Java serialized stream), and does not appear to be obfuscated in any way. I manually parsed the first ...
user avatar
  • 1,243
2 votes

Reverse engineering a proprietary GPU device driver?

Hum ... Reverse engineering such a large piece of software will require a lot of will, time, and, of course, technical knowledge. Honestly, unless you're considering starting a company or providing ...
user avatar
  • 2,603
2 votes

How rootkits hide services on kernel mode?

rootkit in kernel operate at the same security level as the operating system itself. A rootkit can modify data structures in the Windows kernel using a method known as direct kernel object ...
user avatar
  • 123
2 votes
Accepted

Patch driver loading process

Yes, you would need to patch ci.dll (which contains the list of hardcoded Root CAs) and winload.exe (which validates the integrity of ci.dll). You can find this discussed in http://www.programdevelop....
user avatar
2 votes

How to locate module_init() offset from ELF header of Linux kernel module?

To read with readelf the parameter is "-s": Options are: -a --all Equivalent to: -h -l -S -s -r -d -V -A -I -h --file-header Display the ELF file header -l --program-...
user avatar
  • 121
2 votes
Accepted

Is there any windows API to execute thread on atomic mode?

The Interlocked API may be what you are looking for. Or more generally, here is the MSDN topic on synchronization.
user avatar
2 votes
Accepted

how calculate size of memory that allocated from create specific windows object?

The allocation for most executive objects (like semaphores) is done inside the ObCreateObject() function. As you can see in ObCreateObject()'s prototype, one of the parameters is ObjectSizeToAllocate. ...
user avatar
2 votes

IOCTL Code for Windows driver

you can use a python script to find all the IOCTL codes in your binary, here is a script created for the very same purpose : # Find the IoControlCodes corresponding to # calls to ...
user avatar
2 votes
Accepted

IOCTL Code for Windows driver

IDA comments list case values in decimal, so you need to either use 2237134 as decimal in your code, or convert it to hex (i.e. 0x2222CE) first. Additional issue is that the value 0x2222CE is the ...
user avatar
  • 34.7k
2 votes

Using IDA to automatically annote dynamically imported functions in a driver

I've written an IDAPython script that searches for a string in the bytes preceding MmGetSystemRoutineAddress and FltGetRoutineAddress calls and then marks that call with the function being imported. ...
user avatar
  • 141
2 votes

Redirecting Program Output from /dev/*char_device* to Text File

I have used /dev/ptmx for that purpose: Say i want to intercept data written to /dev/somedevice First i open the master: /dev/ptmx. Then i allocate a slave by calling ptsname. Now rename /dev/...
user avatar
2 votes

Reverse engineering USB peripheral driver

Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a ...
2 votes
Accepted

Where can you find the name of a driver causing a kernel mode crash?

It is possible. Take a minute to read the output from analyze. There's a few fields that will tell you what driver faulted like "FAULTING_MODULE", "IMAGE_NAME", and "MODULE_NAME". It will give you ...
user avatar
  • 91
2 votes

How is lite hash rate (LHR) of Nvidia implemented?

This is mostly speculative, since Nvidia didn't go into details about the implementation details. All I could find was this quote: RTX 3060 software drivers are designed to detect specific attributes ...
user avatar
  • 11.4k
2 votes

IAT Hook via Kernel Driver

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so ...
user avatar
  • 34.7k
1 vote

Reverse engineering USB peripheral driver

I am more familiar with linux but some steps are similar. To find where is your driver, I believe that if you plug your device and go in the Device Manager, click right on the device then properties, ...
user avatar
1 vote

RE USB-Serial device driver [Canon ES-E1 for EOS-1V]

Reversing a USB protocol can be a daunting task but some tools can provide a lot of help. Wireshark understands the USB protocol and can help you make sense of some capture. I have only used on it ...
user avatar
1 vote

Get driver binary

There are some possible reasons for that behavior. As @tmr232 wrote you probably do not see an existing file because it is hidden. In this case enable "show hidden files" option in your file explorer....
user avatar
  • 7,720
1 vote

Trying to reverse engineer teamviewer's printer driver

It seems that unidrv does not require any extra DLLs but just a .GPD file. Looks like you need to analyze the GPD file to figure out how it all works.
user avatar
  • 34.7k
1 vote

Loading a .sys file into Immunity Debugger

.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (ntoskrnl.exe) or ...
user avatar
  • 34.7k
1 vote
Accepted

igdlh64.inf modify custom resolution

DTD Calculator (http://www.avsforum.com/forum/26-home-theater-computers/947830-custom-resolution-tool-intel-graphics-easier-overscan-correction.html) did the job for me. Using it I was able to ...
user avatar
  • 131

Only top scored, non community-wiki answers of a minimum length are eligible