Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 06-03-2004, 03:30
loman
 
Posts: n/a
Question How to debug kernel Drivers??

hello,
I just want to debug a driver with softice, I've never done it before, anyone can told me if I can do it without having source, I know that softice can do it if you've got them, but dunno how to do it without.... anyone knows if it's possible to hide sice of compuware driverstudio 3.1 ( on FTP) icedump I found don't work for version 4.3.1
Thanks a lot,long life to exetools
loman!
Reply With Quote
  #2  
Old 06-03-2004, 15:28
peleon peleon is offline
Friend
 
Join Date: Sep 2003
Posts: 174
Rept. Given: 0
Rept. Rcvd 7 Times in 1 Post
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
peleon Reputation: 7
Hi,

When you have the driver loaded you can put in Softice: "driver drivername", then you will see the Dispatch routines addresses for that driver. Just set up a BPX in the routines addresses that you are interested to trace.

Regards.
Reply With Quote
  #3  
Old 06-03-2004, 16:27
loman
 
Posts: n/a
thanks, when I'll be at home, I'll try!
Reply With Quote
  #4  
Old 06-07-2004, 02:32
ionescu007
 
Posts: n/a
Hi,

It would also be very useful to have the symbols set up for the driver...it will give you a lot of help..as well as the whole OS symbols, since the driver is likely to call other functions in the kernel.

Best regards,
Alex Ionescu
http://www.relsoft.net
Reply With Quote
  #5  
Old 06-12-2004, 12:44
pigman
 
Posts: n/a
Best way!

Best way to debug kernel drivers, install target OS on VMWare,
install there debugger target components.

And Debug it from host OS.

I don't try WinDbg, but Driver Studio works fine.
Reply With Quote
  #6  
Old 06-13-2004, 10:49
fantast_xue
 
Posts: n/a
Talking

I've never made softice work fine with vmware, but windbg was ok.

What should I attend to when I use softice under vmware?

Last edited by fantast_xue; 06-13-2004 at 10:51.
Reply With Quote
  #7  
Old 06-15-2004, 23:04
WhoCares's Avatar
WhoCares WhoCares is offline
who cares
 
Join Date: Jan 2002
Location: Here
Posts: 378
Rept. Given: 9
Rept. Rcvd 13 Times in 11 Posts
Thanks Given: 19
Thanks Rcvd at 96 Times in 46 Posts
WhoCares Reputation: 13
Don't forget IDA + I2S(IDA2Softice) plug-in if you have no source for your target!
__________________
AKA Solomon/blowfish.
Reply With Quote
  #8  
Old 06-16-2004, 03:44
loman
 
Posts: n/a
can you please tell me where to find IDA2Softice??
thanks
loman
Reply With Quote
  #9  
Old 06-16-2004, 13:39
WhoCares's Avatar
WhoCares WhoCares is offline
who cares
 
Join Date: Jan 2002
Location: Here
Posts: 378
Rept. Given: 9
Rept. Rcvd 13 Times in 11 Posts
Thanks Given: 19
Thanks Rcvd at 96 Times in 46 Posts
WhoCares Reputation: 13
why not google it?
__________________
AKA Solomon/blowfish.
Reply With Quote
  #10  
Old 06-16-2004, 14:59
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
Searching? Nah. That's way too hard. Especially is one has to go all the way to the main page of Aaron's Home Page. It IS a TOOL site after all.

Regards,
__________________
JMI
Reply With Quote
  #11  
Old 06-16-2004, 19:41
loman
 
Posts: n/a
I googled it ,
hxxp://www.google.com/search?sourceid=navclient&hl=it&ie=UTF-8&oe=UTF-8&q=IDA2Softice

or

hxxp://www.google.com/search?q=i2s+ida&hl=it&ie=UTF-8

but I wasn't able to find it, sorry
Reply With Quote
  #12  
Old 06-17-2004, 00:42
WhoCares's Avatar
WhoCares WhoCares is offline
who cares
 
Join Date: Jan 2002
Location: Here
Posts: 378
Rept. Given: 9
Rept. Rcvd 13 Times in 11 Posts
Thanks Given: 19
Thanks Rcvd at 96 Times in 46 Posts
WhoCares Reputation: 13
I2S is written by mostek.

hxxp://mostek.subcultural.com/
__________________
AKA Solomon/blowfish.
Reply With Quote
  #13  
Old 06-17-2004, 01:52
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
loman:

Did you, by any chance READ my post?????????

Aaron has a TOOL SITE associated with this Forum. Its at:

http://www.exetools.com (Well duh!)

On the Home Page is a link to:

"updated disassembler: IDA to SoftIce converter/loader v0.02i - added plugIn for IDA 4.19"

which is linked to "http://mostek.subcultural.com/" where you will find the v0.03 of the software.


Regards,
__________________
JMI
Reply With Quote
  #14  
Old 06-17-2004, 08:36
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
To Set the Record Straight:

loman PM'ed me to point out he had not understood my original post because of problems with English. I will say here what I said to him in my reply.

I am also sorry that I did not recognize that English was the problem and recognize now that my earlier post was not that clear for a non-English speaking person.

Reversing is difficult enough when done in one's own language and it is much much harder when trying to learn it in someother language. I have great respect for those who try that difficult task and admiration for those who succeed. My apologies to loman for misunderstanding the problem.

Regards,
__________________
JMI
Reply With Quote
  #15  
Old 06-18-2004, 21:31
saurabh
 
Posts: n/a
Lightbulb

Quote:
Originally Posted by loman
hello,
I just want to debug a driver with softice, I've never done it before, anyone can told me if I can do it without having source, I know that softice can do it if you've got them, but dunno how to do it without.... anyone knows if it's possible to hide sice of compuware driverstudio 3.1 ( on FTP) icedump I found don't work for version 4.3.1
Thanks a lot,long life to exetools
loman!
Also, try to get Windows Checked/Debug Build, it wil be very helpfull IMHO. Microsoft provides the Debug version to MSDN subscribers. I am sure someone on this forum might be having it.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
DriverBuddy:IDA plugin to assist with reverse engineering Windows kernel drivers sh3dow Source Code 0 11-24-2016 02:49
IDA remote debug Linux Kernel Sergey Nameless General Discussion 3 04-03-2012 04:12
Debug drivers -OllyDBG?SoftICE? winndy General Discussion 6 12-15-2005 22:09


All times are GMT +8. The time now is 07:38.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )