Mostrando entradas con la etiqueta windows. Mostrar todas las entradas
Mostrando entradas con la etiqueta windows. Mostrar todas las entradas

lunes, 29 de octubre de 2012

Debugging DriverEntry routine.

Hi!! In this post I will describe how I managed to debug the DriverEntry routine of a driver for which I didn´t have the symbols.

As it is explained here, the DriverEntry name is not fixed across drivers, and you can choose any name you want. What makes a routine the initial one, is precicely the INIT keyword, and when the driver is compiled, the compiler creates a section called "optional" embedded in the driver where it is stored this address in an entry labeled "AddressOfEntryPoint". So all we have to do is find this address and insert a breakpoint in WinDBG.

To do that I used the following utility. Install it, open your driver and there you have:



Now you can insert a new breakpoint with: bp YouDriver+0x000bb09c, or if the driver you want to debug is loaded at boot time, reboot your computer and when WinDbg hits use: bu YouDriver+0x000bb09c.

If everything went fine you should run into a breakpoint inside function ioploaddriver from the Windows Kernel.

Hope it helps! As always, if you find any bug or want to contribute just send a comment. Thanks a lot!