Comments (5)
@Wenzel ,
I found how to get eip from KernelStack:
http://blog.airesoft.co.uk/2009/02/grabbing-kernel-thread-contexts-the-process-explorer-way/
https://github.com/jrmuizel/KStack/blob/master/Driver/KStack.c
I've implemented this in KVM_VMI as:
kthread_stack = self.libvmi.read_addr_va(start_kthrd + self.symbols['offsets']['KTHREAD']['KernelStack'], 0)
ks_eip = self.libvmi.read_addr_va(kthread_stack + 2, 0)
ks_ebp = self.libvmi.read_addr_va(kthread_stack + 3, 0)
The output is like(eip and ebp in following figure):
I think i made mistake to get eip and ebp in above. Am I supposed to change the above code to following for 64 bit windows?
kthread_stack = self.libvmi.read_addr_va(start_kthrd + self.symbols['offsets']['KTHREAD']['KernelStack'], 0)
ks_eip = self.libvmi.read_addr_va(kthread_stack + 2*8, 0)
ks_ebp = self.libvmi.read_addr_va(kthread_stack + 3*8, 0)
Thanks a lot. I didn't reach to this solution without your guides.
from nitro.
Hi @aghamir ,
You can ask questions here also, not worries.
Since you are professional in Windows structs
Not really, but i will help, if i can
find all running process in kernel mode?
So all processes running in ring-0
context ?
by going throught the KTHREADS you are just enumerating all the threads of a given process.
Try to find where the KTHREAD store it's execution context, read the IOPL
flag.
https://en.wikipedia.org/wiki/Protection_ring#IOPL
That's a quick and dirty solution, maybe there is a better way.
from nitro.
@Wenzel Thanks a lot. You've helped me a lot.
So all processes running in
ring-0
context ?
Yes I want to find all threads which be running in ring-0 if scheduler chooses them(in ready and running state in Windows).
Try to find where the KTHREAD store it's execution context, read the
IOPL
flag.
It returns only currently running process execution context. However, I need to find others too.
P.S.: In Linux we can find out a task_struct
will be running in kernel-mode
by seeing stack pointer sp0
and sp
like this:
https://stackoverflow.com/questions/25253231/context-of-linux-kernel-threads
Do you think we can use KTHREAD-->KernelStack
pointer to find out execution context in windows?
from nitro.
@aghamir this KTHREAD->KernelStack
is interesting !
If you can extract the context from there i'm curious if you can find the registers :)
I opened an issue like related to this on one of my projects a few months ago, but didn't investigate further.
Wenzel/r2vmi#19
from nitro.
@Wenzel , I'd really appreciated for your guidance.
The second one(times to 8) was the solution. I will close this issue. That was not issue though.
Thanks a lot. I'm really happy that I have a chance to use your guides.
from nitro.
Related Issues (20)
- Configuration Format
- Use case planning HOT 3
- Backend dispatch_hook exception handling HOT 2
- Minor mistake in libvmi.py HOT 1
- problem about the nitro/readme.md HOT 2
- Some questions about requirements! HOT 1
- Question about setup test vm. HOT 22
- A question about get syscall argument value. HOT 3
- Invalid Qemu command line argument definitions in domain template HOT 6
- Questions about realization of nitro!
- Improve nitro's performance. HOT 6
- process_event() will not necessarly return the right syscall HOT 1
- nitro can hook the function which from user level?
- what's the exactly combination to use nitro? HOT 3
- RuntimeError:Process not found HOT 4
- Why is the name of syscall unknown? HOT 5
- Can Nitro extract the API in windows DLL?
- No module named 'nitro.libvmi'
- RuntimeError: Error: fail to attach to the VM
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nitro.