User Lewis Kelsey

3 votes

2 answers

553 views

Where does IDA load binary in Ida64.exe process?

asked Jul 13, 2022 at 1:34

2 votes

1 answer

323 views

Where is the legacy BIOS stored on a UEFI system?

asked Apr 24, 2021 at 7:34

1 vote

0 answers

38 views

Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?

asked Apr 26, 2021 at 14:29

1 vote

0 answers

278 views

On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?

asked Apr 26, 2021 at 15:03

1 vote

0 answers

98 views

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

asked Jul 5, 2022 at 11:47

1 vote

0 answers

84 views

How does windbg correctly resolve symbol addresses for optimised code?

asked Jul 15, 2022 at 15:22

1 vote

0 answers

127 views

Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything

asked Apr 21, 2021 at 9:42

0 votes

2 answers

280 views

kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works

asked Mar 22, 2021 at 14:47

0 votes

1 answer

142 views

How much of the kernel does remote kernel debugging allow you to debug?

asked Mar 29, 2021 at 12:53

Stack Exchange Network

9 Questions

Where does IDA load binary in Ida64.exe process?

Where is the legacy BIOS stored on a UEFI system?

Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?

On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

How does windbg correctly resolve symbol addresses for optimised code?

Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything

kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works

How much of the kernel does remote kernel debugging allow you to debug?