10
votes
Accepted
How to import Windows DDK headers into IDA?
View->Open subviews->Type Libraries (Shift-F11), right click, Load Type Library..., wdk8_km.
- 36.4k
7
votes
How to import Windows DDK headers into IDA?
Create an empty file, include whatever headers you want, add a DriverEntry and compile with debug symbols enabled and no optimization. Now load the test driver into IDA. If done correctly, All types ...
3
votes
Reverse engineering USB peripheral driver
Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a ...
3
votes
Accepted
IOCTL Code for Windows driver
IDA comments list case values in decimal, so you need to either use 2237134 as decimal in your code, or convert it to hex (i.e. 0x2222CE) first.
Additional issue is that the value 0x2222CE is the ...
- 36.4k
3
votes
Accepted
how calculate size of memory that allocated from create specific windows object?
The allocation for most executive objects (like semaphores) is done inside the ObCreateObject() function. As you can see in ObCreateObject()'s prototype, one of the parameters is ObjectSizeToAllocate.
...
- 20.7k
2
votes
How to locate module_init() offset from ELF header of Linux kernel module?
To read with readelf the parameter is "-s":
Options are:
-a --all Equivalent to: -h -l -S -s -r -d -V -A -I
-h --file-header Display the ELF file header
-l --program-...
- 121
2
votes
Accepted
Is there any windows API to execute thread on atomic mode?
The Interlocked API may be what you are looking for. Or more generally, here is the MSDN topic on synchronization.
2
votes
Using IDA to automatically annote dynamically imported functions in a driver
I've written an IDAPython script that searches for a string in the bytes preceding MmGetSystemRoutineAddress and FltGetRoutineAddress calls and then marks that call with the function being imported. ...
- 141
2
votes
IOCTL Code for Windows driver
you can use a python script to find all the IOCTL codes in your binary, here is a script created for the very same purpose :
# Find the IoControlCodes corresponding to
# calls to ...
2
votes
How rootkits hide services on kernel mode?
rootkit in kernel operate at the same security level as the operating system itself.
A rootkit can modify data structures in the Windows kernel using a method known as direct kernel object ...
- 123
2
votes
Redirecting Program Output from /dev/*char_device* to Text File
I have used /dev/ptmx for that purpose:
Say i want to intercept data written to /dev/somedevice
First i open the master: /dev/ptmx.
Then i allocate a slave by calling ptsname.
Now rename /dev/...
- 1,829
2
votes
Accepted
Where can you find the name of a driver causing a kernel mode crash?
It is possible. Take a minute to read the output from analyze. There's a few fields that will tell you what driver faulted like "FAULTING_MODULE", "IMAGE_NAME", and "MODULE_NAME".
It will give you ...
- 101
2
votes
IAT Hook via Kernel Driver
The problem seems to be in the source address calculation:
&ImportDescriptor.Name + (uintptr_t)ModuleBase
This adds the address of a local variable (which is on the stack) to the image base, so ...
- 36.4k
2
votes
How is lite hash rate (LHR) of Nvidia implemented?
This is mostly speculative, since Nvidia didn't go into details about the implementation details. All I could find was this quote:
RTX 3060 software drivers are designed to detect specific attributes ...
- 11.7k
1
vote
Accepted
IAT Hook via Kernel Driver
So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one.
If the driver is compiled in the debug mode, the RVA for ...
- 49
1
vote
IAT Hook via Kernel Driver
This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community ...
1
vote
Reverse engineering USB peripheral driver
Answers to this question deal with generic reversing of USB devices, but if you want to start from the driver files, find the printer in Device Manager, go to properties, then Driver tab-Driver ...
- 36.4k
1
vote
Reverse engineering USB peripheral driver
I am more familiar with linux but some steps are similar. To find where is your driver, I believe that if you plug your device and go in the Device Manager, click right on the device then properties, ...
- 226
1
vote
WinDBG doesn't resolve function names when debugging kernel module
these should be comments but it grew up
what is the windbg version ?
what is the os version ?
what is the output of lm m "your specific Module"
are the symbols loaded for your Module ?
have ...
- 16.3k
1
vote
Why does IDA Pro fail to add these constants?
IDA does not allow conflicting names anywhere in the database(including enum members).
Most likely both _MAJOR_FUNCTIONS and MAJOR_FUNCTIONS have the same set of members, so the first one wins.
- 36.4k
1
vote
Accepted
Game's anti-cheat complains when driver test-signing mode is on
Sometimes the answer can really be more simple then you'd think.
One approach you could take is that instead of getting your driver to load without test-signing (which seems to be your initial ...
- 11.7k
1
vote
Reverse engineering a USB Fight Stick
You should read about USB HID devices. Also you need a USB sniffer to capture the traffic and see how the fight stick encodes key press events. After you understand how the USB data exchange is done, ...
- 1,840
1
vote
Accepted
Cannot load driver to memory
This is a filesystem filter driver, it cannot be run just like usual driver by creating a service and then starting it. You need to create inf file and register it properly, only then you'll be able ...
- 1,840
1
vote
Break on driver loading with windbg
bp mpAxkSGg3!DriverEntry should work just fine. Otherwise see which functions mpAxkSGg3.sys exports and set breakpoints on them.
- 1,840
1
vote
RE USB-Serial device driver [Canon ES-E1 for EOS-1V]
Reversing a USB protocol can be a daunting task but some tools can provide a lot of help. Wireshark understands the USB protocol and can help you make sense of some capture. I have only used on it ...
- 226
1
vote
Trying to reverse engineer teamviewer's printer driver
It seems that unidrv does not require any extra DLLs but just a .GPD file.
Looks like you need to analyze the GPD file to figure out how it all works.
- 36.4k
1
vote
Loading a .sys file into Immunity Debugger
.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (ntoskrnl.exe) or ...
- 36.4k
1
vote
Accepted
igdlh64.inf modify custom resolution
DTD Calculator (http://www.avsforum.com/forum/26-home-theater-computers/947830-custom-resolution-tool-intel-graphics-easier-overscan-correction.html) did the job for me.
Using it I was able to ...
- 131
1
vote
Get driver binary
There are some possible reasons for that behavior.
As @tmr232 wrote you probably do not see an existing file because it is hidden. In this case enable "show hidden files" option in your file explorer....
- 8,388
1
vote
Accepted
Confused about calling convention in a Windows kernel mode driver
Most likely it's just LTCG/LTO, especially if the function in question is only never called externally. Using it can result in the following:
Cross-module inlining
Interprocedural register allocation ...
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible