VirtualKD

by sysprogs C Version: Current License: No License

X-Ray Key Features Code Snippets Community Discussions(2)Vulnerabilities Install Support

kandi X-RAY | VirtualKD Summary

VirtualKD is a C library. VirtualKD has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

VirtualKD

Support

Quality

Security

License

Reuse

Support

VirtualKD has a low active ecosystem.

It has 211 star(s) with 88 fork(s). There are 25 watchers for this library.

It had no major release in the last 6 months.

There are 11 open issues and 1 have been closed. On average issues are closed in 2 days. There are 2 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of VirtualKD is current.

Quality

VirtualKD has no bugs reported.

Security

VirtualKD has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

VirtualKD does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

VirtualKD releases are not available. You will need to build from source code and install.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of VirtualKD

Get all kandi verified functions for this library.

VirtualKD Key Features

No Key Features are available at this moment for VirtualKD.

VirtualKD Examples and Code Snippets

No Code Snippets are available at this moment for VirtualKD.

Community Discussions

Trending Discussions on VirtualKD

Why the DLL loaded in memory doesn't fully correspond to the original DLL file?

How to do hybrid user-mode/kernel-mode debugging?

QUESTION

Why the DLL loaded in memory doesn't fully correspond to the original DLL file?

Asked 2021-May-19 at 12:39

Please, correct me if I'm wrong anywhere...

What I want to do: I want to find a certain function inside some DLL, which is being loaded by Windows service, during remote kernel debugging via WinDBG. (WinDBG plugin in IDA + VirtualKD + VMWare VM with Windows 10 x64). I need to do it kernel mode, because I need to switch the processes and see all the memory

What I did:

I found an offset to the function in IDA (unfortunately, the DLL doesn't have debug symbols).
Connected to the VM in Kernel Mode.
Found the process of the service by iterating over the svchost-processes (!process 0 0 svchost.exe) and looking at CommandLine field in their PEBs (C:\Windows\system32\svchost.exe -k ...).
Switched to the process (.process /i ; g), refreshed the modules list (.reload)
Found the target DLL in user modules list and got its base address.

The problem: The DLL loaded into memory doesn't fully correspond to the original DLL-file, so I can't find the function there. When I jump to the address like + there is nothing there and around. But I found some other functions using this method, so it looks correct. Then I tried to find the sequence of bytes belonging to the function according to the original DLL-file and also got nothing. The function uses strings, which I found in data section, but there are no xrefs to them. Looks like that function has completely disappeared...

What am I doing wrong?

P.S.: Also I dumped memory from to and compared it with the original file. Besides different jump addresses and offsets, sometimes the assembler code is completely missed...

...

ANSWER

Answered 2021-May-19 at 12:35

It appeared that the memory pages were paged out. .pagein command did the trick

Source https://stackoverflow.com/questions/67586771

QUESTION

How to do hybrid user-mode/kernel-mode debugging?

Asked 2017-Mar-16 at 12:50

Basically, I have a user mode program that calls kernel32.CreateProcessA() which internally calls kernel32.CreateProcessInternalW(). Within this function, I'm interested in what is happening inside ntdll.NtCreateSection() which attempts to map the executable in virtual memory. Once in this function, the program quickly sets up the kernel call as EAX=0x32 and executes the SYSENTER instruction.

Obviously I can't see beyond the call gate in a user mode debugger. I have a little experience debugging kernel-mode drivers, so I loaded a copy of XP SP3 in a VMWare window and used VirtualKD to conect the pipe to the WinDbg (which I happen to be running inside IDA). After connecting the kernel debugger, I copied my user-mode EXE program and PDB onto the virtual machine, but I'm kind of at a loss on how to set the initial breakpoint in my user-mode program properly. I don't want to intercept all calls to the equivalent ntdll.ZwCreateSection() which I believe to be on the other side of the call gate. Ideally, I'd like to break into the user-mode code and step through that call gate now that I'm using a Kernel debugger, but I don't know what the first steps are.

I've done some googling and I've come close by setting a "ntsd -d" value in

...

ANSWER

Answered 2017-Mar-16 at 12:50

Use ntsd -d and start debugging the executabke from target with a kd connection you can use the kd as an usermode debugger as well as kernel debugger read the docs several times it is not easy doing it furst time but over several trials you should get the hang of it read about .breakin etc

How to break on the entry point of a program when debug in kernel mode with windbg?

edited to add a demo for using ntsd -d

setup

Source https://stackoverflow.com/questions/42776503

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install VirtualKD

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: