Windows Kernel Debugging

How to set up the Windows Kernel Debugging, please see article:
http://www.blogger.com/blogger.g?blogID=6275589693478001671#editor/target=post;postID=4149230560487743600

Some useful commands:
> dt _eprocess // see the structure of eprocess
> dt _peb // process environment block
> dt _kprocess // kernel process structure
> dt _heap // heap structure
> dt _ heap_segment
> dt  _heap_entry

Application debugging(e.g. firefox)
> !process 0 0 // list all the running process
> .context <dirbase_address> // this is to enable the context, and you can find the dirbase address from !process 0 0 command in firefox process info. Sometimes, you need to run command before enable the context
>.enable forcedecoderuser

> dt _peb <peb_address_of_Firefox>

> dd <address> // you can see the content of that location, like the x command in QEMU

> dd /p <address> // see the physical address content

> dt _heap <heap_address>

> dt _heap_entry <heap_entry_address>

Disable PAE on Windows XP SP3

Go to computer -> properties, it will show in the hardware specification if the PAE enabled.
Enabling PAE (by setting bit 5, PAE, of the system register CR4), which is the sixth bit from the left. 

Disable method:

Normal boot.ini with PAE & DEP

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Pro x86" /noexecute=optin /fastdetect

Disabled DEP & PAE

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Pro x86" /execute /fastdetect

__________________

wget in Mac

echo 'alias wget="curl -O"' >> ~/.bash_profile


curl -0 url > filename
-0 means http
save the file to filename
more see man curl

Windows Kernel Debugging by using serial port

1. Setup two machines: target machine and debugging machie

2. Download windbg at the debugging machine
http://msdn.microsoft.com/en-us/windows/hardware/gg463009
for window XP you need to download the Windows 7 version

3. Change the boot.ini file in taget machine to recognize com1 serial port.

4. Boot target machine into debugging mode ( press F8 when booting)

5. Start windbg at the debugging machine, and choose the correct device.
e.g. Serial port to USB

6. Set the the correct symbol table path.
e.g. srv*c\symbols*http://msdl.microsoft.com/download/symbols

7. run dt _eprocess

How to change boot.ini
http://www.etdot.com/2008/04/16/windbg-and-vmware/
http://support.microsoft.com/kb/289022

You also can get more information from: Windows Internals book 5 Edition

Another book： Advanced Windows Debugging

QEMU usage menu page

http://wiki.qemu.org/download/qemu-doc.html

common commands:
stop: stop the virtual machine
c/count: resume the machine

x /20w location: see the content at location
x /20c location: see the content by character
x /fmt location: fmt could be count, format, size

xp /20w location: see the content at physical memory location

How to find PsActiveProcessHead in memory on Windows

PsActiveProcessHead is a pointer to the start of the kerne's list of _EPROCESS structures.

1. Get the FS register value: 0xffdff000, which points to the Kernel Processor Control Region (KPCR) structure

2. KDVersionBlock is at the offset 0x34 of KPCR

3. Get the KdVersionBlock value: 0x8054c738 (run x /20w 0xffdff034 in QEMU monitor)

4. PsActiveProcessHead is at the offset 0x78 of KdVersionBlock, which is at location 0x8054c7b0

5. Get the PsActiveProcessHead value: 0x80560bd8 ( run x /20w 0x8054c7b0)

6. See the LIST_ENTRY field of PsActiveProcessHead, and it is a double linked list.
7. See the process name ( run x /20c location)

More Info:

http://www.reverse-engineering.info/SystemInformation/GetVarXP.pdf

Find useful memory in windows

http://www.reverse-engineering.info/SystemInformation/GetVarXP.pdf

http://forum.sysinternals.com/devphysicalmemoryfinding-my-peb_topic3473.html

http://moyix.blogspot.com/2008/04/finding-kernel-global-variables-in.html

http://download.sysinternals.com/Files/WindowsInternals-Ch05.pdf

http://www.facultyresourcecenter.com/curriculum/ResourceKits/Default.aspx?c1=en-us&c2=0