10 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
0xC0000022L's user avatar
  • 10.9k
10 votes
Accepted

Faster Kernel debugging for Windows

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org
Elias Bachaalany's user avatar
10 votes

How does the Windows Native API communicate with the kernel?

ntdll.dll is not privileged in any sense and can't do anything that your user mode library can't. So no, it doesn't have "permission" do directly call kernel-mode code and it doesn't do that. What it ...
conio's user avatar
  • 672
9 votes
Accepted

Do all drivers exist in Kernel mode?

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver ...
Jason Geffner's user avatar
8 votes
Accepted

What are the difference syscall and int 0x2E instructions?

7FFE0308h is a pointer inside the KUSER_SHARED_DATA struct. The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to ...
Abigail's user avatar
  • 684
7 votes

Debug a windows service entry without windbg

I'll post my own answer here so I can find this again in the future. Using CFF Explorer open the service binary. Find the AddressOfEntryPoint in the Optional Header. Find the .text entry in Section ...
Twifty's user avatar
  • 422
6 votes

What are the difference syscall and int 0x2E instructions?

int 2Eh is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using syscall. The check done on memory address 0x7ffe0300 is one of the ways to detect the bitness.
Paweł Łukasik's user avatar
5 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

By definition, 32 bit systems cannot have more than 64 CPU cores (either virtual or physical). This is a hard limit on Microsoft's side for reasons unknown. One can assume those limitations are ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

Windows - syscalls being called in a strange way?

Following cites, answering your first question come from Windows Internals Sixth Edition Part 1, page 225: Wow64 (Win32 emulation on 64-bit Windows) refers to the software that permits the ...
bart1e's user avatar
  • 3,389
4 votes
Accepted

WinDBG. How to catch first-chance exceptions?

In WinDbg: !gflag +soe You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.
Jason Geffner's user avatar
4 votes
Accepted

How can WinDbg be used to troubleshoot program loading?

I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it ...
Igor Skochinsky's user avatar
  • 36.6k
4 votes

Faster Kernel debugging for Windows

GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging. The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4. Around 34 min in the stream 1 he mentions ...
Paweł Łukasik's user avatar
3 votes
Accepted

[windbg]kd - sxe ld <dll> from a process context won't fire

I think usually this enables stopping on loading of kernel modules only (e.g. drivers). However, this SO answer claims it can work for user-mode processes if you send !gflag +ksl first (Enable loading ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes
Accepted

How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?

In order to step into syscall you must debug your machine from kernel mode debugger. https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf see Debugging the kernel with VMWare ...
Anton Kukoba's user avatar
  • 1,840
3 votes
Accepted

IOCTL Code for Windows driver

IDA comments list case values in decimal, so you need to either use 2237134 as decimal in your code, or convert it to hex (i.e. 0x2222CE) first. Additional issue is that the value 0x2222CE is the ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes
Accepted

How find address of specific pool allocated?

In WinDbg, you can use the !poolfind command: The !poolfind extension finds all instances of a specific pool tag in either nonpaged or paged memory pools. ... kd> !poolfind SeSd 0 ...
Jason Geffner's user avatar
3 votes
Accepted

Advice about first steps on reversing windows kernel

First and most important advice I can give you is to not debug on your host machine, use a virtual machine such as hyper-v, VMWare and virtualbox instead. Second, your preferred tool is WinDbg. ...
GelosSnake's user avatar
2 votes

Advice about first steps on reversing windows kernel

Since this is tagged windows, getting that kind of information is fairly easy these days: Go read Windows Internals by Russinovich, et all. This is an excellent book (actually two books) on how ...
josh poley's user avatar
2 votes

IOCTL Code for Windows driver

you can use a python script to find all the IOCTL codes in your binary, here is a script created for the very same purpose : # Find the IoControlCodes corresponding to # calls to ...
Mohammed Janati Idrissi's user avatar
2 votes

Kernel debug - internet explorer in kernelmode?

On the pte command you use an address from where did you get that address FFFFF6FB7EA00068 <<<<< If it is a virtual address does it truly belong to the active process context ? are ...
blabb's user avatar
  • 16.4k
2 votes

How can I receive DbgPrint messages in windbg on windows 10

The simple way to turn on the debug information is to modify the mask directly in WinDBG with this command : kd> ed nt!Kd_Default_Mask 8 The console will become massively verbose...
mdev's user avatar
  • 21
2 votes

Is there a ProcMon style program for Kernel-Mode?

The closest thing I'm aware of is DbgKit from Andrey Bazhan. It is not exactly what you are asking for, but it does provide a nice GUI extension on top of WinDbg (which can be used for kernel ...
Mick's user avatar
  • 7,562
2 votes

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

You need to use the correct ethernet cable. If you are connecting target directly to your debugger host you need to use a cross over cable, not a regular ethernet cable. Alternately if you don't have ...
chentiangemalc's user avatar
2 votes

Question about the limit and base address in x86-64 segmentation model?

Q1: In its manual "Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1" Intel writes in the chapter "3.5.1 Segment Descriptor Tables": "As with ...
josh's user avatar
  • 1,974
2 votes

Faster Kernel debugging for Windows

If you are debugging a newer version of Windows (Windows 8 or higher I believe). You should checkout network based debugging. Works like a charm. No third party dependencies. Just open up a cmd ...
Bambu's user avatar
  • 556
2 votes

Why base address of GDT(global descriptor table) differ in intel x64 processor?

IIRC on Linux GDT is separate for each processor so you’re probably seeing the addresses for different processors.
Igor Skochinsky's user avatar
  • 36.6k
2 votes

IAT Hook via Kernel Driver

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

Linux Kernel for embedded platform - Available Sources but no configuration

You could try to compare the symbol tables for the custom kernel and the official kernel either by looking at the system.map file or get it from the running system via /proc/kallsyms (might need to ...
secfren's user avatar
  • 71
1 vote

Find address of kernel function

Type lm m abc.sys in windbg and find out what is the loaded address. Let's say windbg shows abc.sys 0x97370000 Now go to IDA and rebase the loaded image in IDA. If I recall correctly, menu ...
blabb's user avatar
  • 16.4k
1 vote
Accepted

Game's anti-cheat complains when driver test-signing mode is on

Sometimes the answer can really be more simple then you'd think. One approach you could take is that instead of getting your driver to load without test-signing (which seems to be your initial ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible