Various life as a Person

2016-07-14

The dbgPrint or kdprint don't work appearing message in windbg

Preinstalled

OS : Windows 2012 R2

Cause:

Higher version of the windows than the vista , DbgPrint and KdPrint is mapped each DbgPrintEx, KdPrintEx automatically.

At this timing, DbgPrintEx will be called with Parameter 'DFLTR_INFO_LEVEL'. and, Which has 0x3 value meaning to print limited as default .

Solution:

Temporarily, you can run to fix ti with command

kd > ed Kd_DEFAULT_MASK 8

And , Each number means next....

#define DPFLTR_ERROR_LEVEL 0
#define DPFLTR_WARNING_LEVEL 1
#define DPFLTR_TRACE_LEVEL 2
#define DPFLTR_INFO_LEVEL 3
#define DPFLTR_MASK 0x80000000
If you want to fix it permanently....

KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\

If the key 'Debug Print Filter' is not in there , add the key ,else change values as 0xF.
If there is not a dword of type named 'DEFAULT' , add it with value f by yourself.

※ Reference : https://msdn.microsoft.com/en-us/library/ff551519.aspx

2016-07-13

Basis of windows kernel debugging

Windows Driver Debugging with WinDbg.

Window Memory architecure

windows kernel debugging model

Debugging types

User mode debugging

It is debugging a process that is started on user mode.

by visual studio , windbg

Kernel mode debugging

It is debugging a process that is started on Kernel mode.

by windbg

live debugging

it is debugging a process that is running step by step each line of source.

dump debugging

It is a analying dump when is created at the system crash or blue screen.

Terms

user dump

It is a dump on the user mode.

kernel dump

It is a dump on the kernel mode.

the debugger

It means a something installed tools for debugging.

the debugee

it means target like processes or drivers will be debugged.

Debug Symbols

such as a pdb files

it includes function, variablable’s name and location and source line.

Stack

In x86 arch , The register ESP, EBP invloves meaning of the stack’s start and stop address.

Command Prompt

0:000> - The first part of ‘0’ being means process number. and, The left ‘000’ part is thread number

kd> - The kernel mode command prompt.

0: kd > The front ‘0’ is the Processor( means cpu ) number. and ‘kd’ means being that is in kernel mode.

windbg commands

Debugger Commands

r - register - Display cpu resister information.
k - call stack - Show call stack backtrace
g - go - keep going kernel
p - pause - pause step
pc - - Step to next call
t - trace -
tb - - trace to next branch
tc - - trace to next call
wt - - Trace and watch data
a - assemble
u - unassemble
bc - breakpoint cleaar
bd - breakpoit disable
be - breakpoit enable
bl - breakpoit list
ba - break on access
d , da, db, dw, dd - display - display memory
dds - - display word and symbol
dl - - display linked list
ds - - Display string
dt - - Display type
dv - - Display local variable
s - - Search memory
ls - - load symbol
lm - - list loaded symbol
ln - - list nearest symbol
k, kb, kd, kp, kv - - display stack backtrace
e, ea, ed, ed, ew, eu - enter - enter values
etc...

Meta Commands

.sympath - Set symbol path
.reload - Reload module
.srcpath - set source path
.exepath - Set executable path
.trap - Display trap frame
.ecxr - Display exception context record
.exr - Display exception record
.cxr - Display context record
.reboot - reboot target compter
.dump - Create dump file
.enable_uncode - Enable unicode display
.ofilter - Filter target output
.cls - clear screen
.bugcheck - Display bug check data
.context - Set user mode address context
.process -Set process context
.thread - Set register context
.tss - display Task stte segment
.load - Load extension dll
etc...

Extension Commands

!anlyze - Displays information about the current bug check
!cpuid - Displays information about the prosessors on the system
!error - Decodes and displays information about an error value
!gle - Displays the last error value for the current thread
!obja - Displays the attributes of an oobject in the object manager
!peb - D!peb - Display a fomattes view of the information in the processs environment block (PEB)
!teb - Display a fomatted view of the information in the thread environment block (PEB)
!token - Display a formatted view of a security token object
!process - Displays information about the specified process or all
!stacks - Display a information about a current kernel stacks
!thread - Displays summary information about a thread
!zombies - Displays all dead “zombie” processes or thread
!drivers - Displays list of all drivers loaded
!devnote - Displays a formatted view of the device stack
!devobj -Displays detailed information about a DEVICE_OBJECT
!devstack - Displays a formatted view of the device stack
!drvobj -Displays detailed information about a DRIVER_OBJET
etc..

error LNK2019: unresolved external symbol DriverEntry referenced in function GsDriverEntry

I was going with visual studio 2013 , wdk 8.1 and legacy kernel driver code.
Then, i faced a message LNK2019. It was not a problem in source code.

As you have got a following messages, when you had built a project.

1>------ Build started: Project: MyDriver1, Configuration: Win8.1 Debug x64 ------

1> Source.cpp

1>BufferOverflowFastFailK.lib(gs_driverentry.obj) : error LNK2019: unresolved external symbol DriverEntry referenced in function GsDriverEntry

1>C:\Users\Administrator\Desktop\helloworld\MyDriver1\x64\Win8.1Debug\MyDriver1.sys : fatal error LNK1120: 1 unresolved externals

========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========

========== Deploy: 0 succeeded, 0 failed, 0 skipped ==========

Basically, visual studio 2013 does not support C that is file extension .

To use C , you have to use statement 'extern c{}' like this.

extern "C" { VOID Unload( _In_ struct _DRIVER_OBJECT *DriverObject )
......... }
}

2016-07-11

How to "hello world" Legacy Kernel Driver

Preinstalled

Visual Studio 2013
WDK 8.1
Windows 2012 R2
Debug View

Step

start Visual Studio.
Click on the FILE > NEW > Proejct. then Pop up a ‘new Project’ wizard.
Choose the visual C++ > Windows driver > Empty WDM driver Project.
You could see the two projects on the solution explorer, The one is your own name, and the ohter one is package project for your driver
Select ‘Source files’ on the Solution Explorer that in the right side.
Click Mouse right button and click ‘add’ > ‘new item’. then Pop up a ‘new file’ wizard.
Choose the visual C++ > C++ file.
Copy a following basis of source code, and paste it on the ‘ new c++ file’ that you have created.

helloworld.cpp

#include <ntddk.h>

VOID Unload(

_In_ struct _DRIVER_OBJECT *DriverObject

)

{

UNREFERENCED_PARAMETER(DriverObject);

DbgPrintEx(DPFLTR_DEFAULT_ID, 0xFFFFFFFF, "GoodBye Windows Kernel\n");

return;

}

NTSTATUS DriverEntry(

_In_ struct _DRIVER_OBJECT *DriverObject,

_In_ PUNICODE_STRING RegistryPath)

{

NTSTATUS status = STATUS_SUCCESS;

UNREFERENCED_PARAMETER(RegistryPath);

DbgPrintEx(DPFLTR_DEFAULT_ID, 0xFFFFFFFF, "Hello Windows Kernel\n");

DriverObject->DriverUnload = Unload;

return status;

}

Select a build platform and a architecture, then run ‘build’
As a result you can see the driver file that named end with .sys in ther subfolder of your project’s location.
Remeber file’s full path or copy it to root folder.
For the test, first , you register driver as a service simply.

Resigist a driver as a service.

sc create helloworlddriver binpath=D:\helloworld.sys type=kernel

Run debugview app to see kernel messages from your driver by a ‘DbgPrintEx’.
(Turn on the capture kernel function.)
Start and stop your own driver.

Start a driver service.

sc start helloworlddriver

Stop a a driver service.

sc stop helloworlddriver

Now, Confirm it worked well on the debugview.
Finally, ungister the your driver.

Unresigist a driver

sc delete helloworlddriver