View Single Post
  #6  
Old 03-09-2005, 22:34
JuneMouse
 
Posts: n/a
read some microsoft.public.kernel or microsoft.public.windbg

livekd instalss a driver and fools the os to think it as a crashdump file
and fakes some context structures and redirects the ioctl to read the kernel memory

and the ms guys picked it upon that idea and implemented it in xp
as Local Kernel Debugging so it is a reversers contribution in some twisted
context

but in xp they dont fake context structures and such because they had the complete source code for thier os as well as russinovichs app
Reply With Quote