9 votes

How does sysenter instruction in windows 7 work?

Here is a perfect explanation how sysenter works: http://www.osronline.com/article.cfm?id=257 In essence: All native API calls from User Mode have a body that simply loads an index into EAX, executes ...
  • 336
9 votes
Accepted

Do all drivers exist in Kernel mode?

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver ...
9 votes

How does the Windows Native API communicate with the kernel?

ntdll.dll is not privileged in any sense and can't do anything that your user mode library can't. So no, it doesn't have "permission" do directly call kernel-mode code and it doesn't do that. What it ...
  • 632
9 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
  • 10.5k
8 votes
Accepted

Faster Kernel debugging for Windows

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org
7 votes

Debug a windows service entry without windbg

I'll post my own answer here so I can find this again in the future. Using CFF Explorer open the service binary. Find the AddressOfEntryPoint in the Optional Header. Find the .text entry in Section ...
  • 422
7 votes
Accepted

What are the difference syscall and int 0x2E instructions?

7FFE0308h is a pointer inside the KUSER_SHARED_DATA struct. The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to ...
  • 664
6 votes
Accepted

Unable to break at DriverEntry of malicious Driver

Try "break on module load" (e.g. sxe ld malicious_driver.sys). When it's hit, you can check the driver's load address and set breakpoint by address.
  • 35.1k
5 votes

How to find status and path of the specific module with C in the windows?

VirtualQueryEx() is the way to go if you want a memory map of a target process. However, if you want information about modules only, you can extract it from the PEB of the target process. Get the ...
  • 578
5 votes

Kernel debugging - how to set breakpoint at DriverEntry?

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else ...
  • 35.1k
5 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

By definition, 32 bit systems cannot have more than 64 CPU cores (either virtual or physical). This is a hard limit on Microsoft's side for reasons unknown. One can assume those limitations are ...
  • 11.4k
5 votes

What are the difference syscall and int 0x2E instructions?

int 2Eh is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using syscall. The check done on memory address 0x7ffe0300 is one of the ways to detect the bitness.
5 votes
Accepted

Windows - syscalls being called in a strange way?

Following cites, answering your first question come from Windows Internals Sixth Edition Part 1, page 225: Wow64 (Win32 emulation on 64-bit Windows) refers to the software that permits the ...
  • 3,209
4 votes
Accepted

Determining the number of instructions executed by a driver

I'd recommend using Bochs. It'll allow you to write code to count the number of instructions (and/or number of different instructions) executed between a SYSCALL/SYSRET, SYSENTER/SYSEXIT, etc.
4 votes
Accepted

WinDBG. How to catch first-chance exceptions?

In WinDbg: !gflag +soe You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.
4 votes

Faster Kernel debugging for Windows

GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging. The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4. Around 34 min in the stream 1 he mentions ...
4 votes
Accepted

How can WinDbg be used to troubleshoot program loading?

I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it ...
  • 35.1k
3 votes
Accepted

How find address of specific pool allocated?

In WinDbg, you can use the !poolfind command: The !poolfind extension finds all instances of a specific pool tag in either nonpaged or paged memory pools. ... kd> !poolfind SeSd 0 ...
3 votes
Accepted

IOCTL Code for Windows driver

IDA comments list case values in decimal, so you need to either use 2237134 as decimal in your code, or convert it to hex (i.e. 0x2222CE) first. Additional issue is that the value 0x2222CE is the ...
  • 35.1k
3 votes
Accepted

Kernel debugging between two virtual machines not working

Fixed the problem.. On the windbg client, uncheck the 'Reconnect' and 'Pipe' checkboxes on the COM tab - then it will connect to the debugger.
  • 658
3 votes
Accepted

Advice about first steps on reversing windows kernel

First and most important advice I can give you is to not debug on your host machine, use a virtual machine such as hyper-v, VMWare and virtualbox instead. Second, your preferred tool is WinDbg. ...
3 votes

How does sysenter instruction in windows 7 work?

The SYSENTER instruction affects many registers, but most importantly it sets EIP to the value of the SYSENTER_EIP_MSR register (in IA-32 terminology). At boot-time, Windows sets SYSENTER_EIP_MSR to ...
3 votes

Detecting SSDT and inline hooks in kernel

If your looking for SSDT hooking with WinDbg, have tried the SwishDbgExt.dll? Here is the link to the author's page - http://www.msuiche.net/2014/07/16/thats-so-swish Update: http://www.msuiche.net/...
  • 61
3 votes

Kernel debugging - how to set breakpoint at DriverEntry?

patch the Address of Entry Point with a (0xcc aka int 3) and load the driver AddrOfEntryPoint normally points to either DriverEntry or GsDriverEntry when broken you need to replace 0xcc by ...
  • 15.2k
3 votes
Accepted

VirtualKD + VBox > 4.3

As I think, someone else might have this problem, I have to answer my own question... First. please read the question carefully ( it is long but worst it ). Then... As Virtual Box only accepts ...
  • 108
3 votes
Accepted

How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?

In order to step into syscall you must debug your machine from kernel mode debugger. https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf see Debugging the kernel with VMWare ...
  • 1,770
3 votes
Accepted

[windbg]kd - sxe ld <dll> from a process context won't fire

I think usually this enables stopping on loading of kernel modules only (e.g. drivers). However, this SO answer claims it can work for user-mode processes if you send !gflag +ksl first (Enable loading ...
  • 35.1k
2 votes
Accepted

Patch driver loading process

Yes, you would need to patch ci.dll (which contains the list of hardcoded Root CAs) and winload.exe (which validates the integrity of ci.dll). You can find this discussed in http://www.programdevelop....
2 votes

Advice about first steps on reversing windows kernel

Since this is tagged windows, getting that kind of information is fairly easy these days: Go read Windows Internals by Russinovich, et all. This is an excellent book (actually two books) on how ...

Only top scored, non community-wiki answers of a minimum length are eligible