Hot answers tagged

3 votes
Accepted

How to disassemble an entire function in Windbg?

uf foo!blah unassemble full function
  • 15.2k
2 votes

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

Found it in the intel dev manual. CR4.CET bit is set which prevents clearing of WP bit
1 vote
Accepted

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

unless you have a private pdb for storport you wouldn't be able to locate the names and even if you have the private pdb it is mostly a guessing game i will show a demo using windbg adapt it to the ...
  • 15.2k
1 vote
Accepted

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

Rebase does not help you in this case, because rebasing is meant to shift virtual addresses in flat mode or physical addresses of real-mode programs, but it does not apply to selectors of segmented ...

Only top scored, non community-wiki answers of a minimum length are eligible