10
votes
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
- 10.9k
9
votes
Accepted
Do all drivers exist in Kernel mode?
Would this driver exist in user space, or in kernel space?
Kernel space.
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver ...
- 20.7k
9
votes
Accepted
Faster Kernel debugging for Windows
You want VirtualKd. It is excellent and robust.
http://virtualkd.sysprogs.org
- 216
9
votes
How does the Windows Native API communicate with the kernel?
ntdll.dll is not privileged in any sense and can't do anything that your user mode library can't. So no, it doesn't have "permission" do directly call kernel-mode code and it doesn't do that.
What it ...
- 632
8
votes
Accepted
What are the difference syscall and int 0x2E instructions?
7FFE0308h is a pointer inside the KUSER_SHARED_DATA struct.
The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to ...
- 684
7
votes
Accepted
Unable to break at DriverEntry of malicious Driver
Try "break on module load" (e.g. sxe ld malicious_driver.sys). When it's hit, you can check the driver's load address and set breakpoint by address.
- 36.4k
7
votes
Debug a windows service entry without windbg
I'll post my own answer here so I can find this again in the future.
Using CFF Explorer open the service binary.
Find the AddressOfEntryPoint in the Optional Header.
Find the .text entry in Section ...
- 422
6
votes
What are the difference syscall and int 0x2E instructions?
int 2Eh is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using syscall. The check done on memory address 0x7ffe0300 is one of the ways to detect the bitness.
- 4,912
5
votes
Trying to understand this construct in Dbgv.sys driver for DbgView tool
By definition, 32 bit systems cannot have more than 64 CPU cores (either virtual or physical). This is a hard limit on Microsoft's side for reasons unknown. One can assume those limitations are ...
- 11.7k
5
votes
Accepted
Windows - syscalls being called in a strange way?
Following cites, answering your first question come from Windows Internals Sixth Edition Part 1, page 225:
Wow64 (Win32 emulation on 64-bit Windows) refers to the software that permits the ...
- 3,369
4
votes
Accepted
WinDBG. How to catch first-chance exceptions?
In WinDbg: !gflag +soe
You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.
- 20.7k
4
votes
Accepted
How can WinDbg be used to troubleshoot program loading?
I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it ...
- 36.4k
4
votes
Faster Kernel debugging for Windows
GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging.
The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4.
Around 34 min in the stream 1 he mentions ...
- 4,912
3
votes
Accepted
[windbg]kd - sxe ld <dll> from a process context won't fire
I think usually this enables stopping on loading of kernel modules only (e.g. drivers). However, this SO answer claims it can work for user-mode processes if you send !gflag +ksl first (Enable loading ...
- 36.4k
3
votes
Accepted
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
In order to step into syscall you must debug your machine from kernel mode debugger. https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf see Debugging the kernel with VMWare ...
- 1,840
3
votes
Accepted
How find address of specific pool allocated?
In WinDbg, you can use the !poolfind command:
The !poolfind extension finds all instances of a specific pool tag in
either nonpaged or paged memory pools.
...
kd> !poolfind SeSd 0
...
- 20.7k
3
votes
Accepted
IOCTL Code for Windows driver
IDA comments list case values in decimal, so you need to either use 2237134 as decimal in your code, or convert it to hex (i.e. 0x2222CE) first.
Additional issue is that the value 0x2222CE is the ...
- 36.4k
3
votes
Accepted
Kernel debugging between two virtual machines not working
Fixed the problem..
On the windbg client, uncheck the 'Reconnect' and 'Pipe' checkboxes on the COM tab - then it will connect to the debugger.
- 668
3
votes
Accepted
Advice about first steps on reversing windows kernel
First and most important advice I can give you is to not debug on your host machine, use a virtual machine such as hyper-v, VMWare and virtualbox instead.
Second, your preferred tool is WinDbg. ...
- 712
2
votes
Advice about first steps on reversing windows kernel
Since this is tagged windows, getting that kind of information is fairly easy these days:
Go read Windows Internals by Russinovich, et all. This is an excellent book (actually two books) on how ...
- 851
2
votes
How rootkits hide services on kernel mode?
rootkit in kernel operate at the same security level as the operating system itself.
A rootkit can modify data structures in the Windows kernel using a method known as direct kernel object ...
- 123
2
votes
IOCTL Code for Windows driver
you can use a python script to find all the IOCTL codes in your binary, here is a script created for the very same purpose :
# Find the IoControlCodes corresponding to
# calls to ...
2
votes
Kernel debug - internet explorer in kernelmode?
On the pte command you use an address from where did you get that address FFFFF6FB7EA00068 <<<<<
If it is a virtual address does it truly belong to the active process context ?
are ...
- 16.3k
2
votes
How can I receive DbgPrint messages in windbg on windows 10
The simple way to turn on the debug information is to modify the mask directly in WinDBG with this command :
kd> ed nt!Kd_Default_Mask 8
The console will become massively verbose...
- 21
2
votes
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
You need to use the correct ethernet cable. If you are connecting target directly to your debugger host you need to use a cross over cable, not a regular ethernet cable. Alternately if you don't have ...
- 1,235
2
votes
Question about the limit and base address in x86-64 segmentation model?
Q1: In its manual "Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1"
Intel writes in the chapter "3.5.1 Segment Descriptor Tables":
"As with ...
- 1,964
2
votes
Faster Kernel debugging for Windows
If you are debugging a newer version of Windows (Windows 8 or higher I believe). You should checkout network based debugging. Works like a charm. No third party dependencies.
Just open up a cmd ...
- 556
2
votes
Is there a ProcMon style program for Kernel-Mode?
The closest thing I'm aware of is DbgKit from Andrey Bazhan. It is not exactly what you are asking for, but it does provide a nice GUI extension on top of WinDbg (which can be used for kernel ...
- 7,542
2
votes
Why base address of GDT(global descriptor table) differ in intel x64 processor?
IIRC on Linux GDT is separate for each processor so you’re probably seeing the addresses for different processors.
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible