flat assembler
Message board for the users of flat assembler.

Index > Windows > DETOUR, HOOK, DLL imports change and any code INTERCEPTION!

Goto page 1, 2, 3  Next
Author
Thread Post new topic Reply to topic
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Twisted Evil I've just started to learning more about the detouring method, hooking (in user mode) and any-type of code execution interception.
Now i'm tryng to hook any API call in KERNEL MODE, but i need a FREEWARE KERNEL MODE DEBUGGER....!!!!

Who can tell me where i can give a FREEWARE Kernel debugger for XP?

RR0D.exe is undownloadable!?!? SoftICE doesn't want to start! MMMMMMMMHHH!!!!!!! Evil or Very Mad
Post 31 Oct 2008, 18:09
View user's profile Send private message Send e-mail Reply with quote
windwakr



Joined: 30 Jun 2004
Posts: 827
Location: Michigan, USA
windwakr
You should post this in windows forum, this forum is for making an OS
Post 31 Oct 2008, 18:11
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Sorry, i've just registed about 17 minutes ago... OK
Post 31 Oct 2008, 18:14
View user's profile Send private message Send e-mail Reply with quote
windwakr



Joined: 30 Jun 2004
Posts: 827
Location: Michigan, USA
windwakr
But while we're here, is THIS what you want?

_________________
----> * <---- My star, won HERE
Post 31 Oct 2008, 18:14
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
No, thanks, i've tryed this program. this is a USER MODE DEBUGGER
i need a FREWARE KERNEL MODE DEBUGGER, like SYSER or RASTA RING 0 DEBUGGER.
Post 31 Oct 2008, 18:24
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
I use IDA Pro disassembler for debuggin any type of programs but it cant trace over the SYSENTER instruction, entering the system gate.

( You can find the SYSENTER into the NTDLL.DLL at the export:

KiFastSystemCall

)

only a Kernel debugger can let you see the code into the system area.
Post 31 Oct 2008, 18:28
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Cause i've created a library that remove all kind of firewall or anti-virus DETOUR (intercepting), but did it in user mode.
Post 31 Oct 2008, 18:30
View user's profile Send private message Send e-mail Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
But you can use it as a kernel-mode debugger: http://board.flatassembler.net/topic.php?t=9169
Post 31 Oct 2008, 18:34
View user's profile Send private message Reply with quote
windwakr



Joined: 30 Jun 2004
Posts: 827
Location: Michigan, USA
windwakr
Quote:
Debugging Tools for Windows is a set of extensible tools for debugging device drivers for the Microsoft Windows family of operating systems. Debugging Tools for Windows supports debugging of:

• Applications, services, drivers, and the Windows kernel.

• Native 32-bit x86, native Intel Itanium, and native x64 platforms.

• Microsoft Windows NT 4.0, Windows 2000, Windows XP, Microsoft Windows Server 2003, Windows Vista and Windows Server 2008.

• User-mode programs and kernel-mode programs.

• Live targets and dump files.

• Local and remote targets.



_________________
----> * <---- My star, won HERE
Post 31 Oct 2008, 18:34
View user's profile Send private message Reply with quote
asmcoder



Joined: 02 Jun 2008
Posts: 784
asmcoder
[content deleted]


Last edited by asmcoder on 14 Aug 2009, 14:55; edited 1 time in total
Post 31 Oct 2008, 20:35
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
Quote:
yes im dumb, i dont understand many things, like HOW TO USE that thing @up

Well... I am the last one to speak here, 'cause I am lazy myself to learn it properly, but... how about just going through the manual? I believe that would teach you much more than you need.
Post 01 Nov 2008, 02:25
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
I've resolved my problem! tanks you all.
Now i'll make my personal DETOUR REMOVER like a DRIVER in kernel mode! (MORE STRONGER!)
Post 03 Nov 2008, 09:55
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Who knows why when i overwrite the original NTDLL.DLL with my NTDLL.DLL modifyed (the code debugged work well, there is no error or bug) the system restart?

There is a CHECKSUM control, or what?


Last edited by Pirata Derek on 03 Nov 2008, 12:17; edited 3 times in total
Post 03 Nov 2008, 12:06
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
I modify only the original KiFastSystemCall function:

KiFastSystemCall: MOV EDX,ESP
SYSENTER
NOP
NOP
NOP
.......
KiFastSystemCallRet: RET
Post 03 Nov 2008, 12:08
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
.....(CORRECTION) The SYSTEM RESTART AUTOMATICALLY AFTER A FEW SECONDS OF CORRECT STARTING..........
Post 03 Nov 2008, 12:09
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
The modifyed function is:

KiFastSystemCall: CALL ....... ----> Somewhere i want to jump for control
MOV EDX;ESP
SYSENTER
NOP
KiFastSystemCallRet: RET
Post 03 Nov 2008, 12:13
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Is the same with this change:

KiFastSystemCall:
__Hooked:
PUSHD ....... -----> Somewhere i want
RET
__Return from hook:
MOV EDX;ESP
SYSENTER

KiFastSystemCallRet: RET
Post 03 Nov 2008, 12:20
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
I need this code work because my little TEST PROGRAM must try to remove (in USER MODE) my DRIVER HOOK (in kernel mode)

If the TEST PROGRAM wins (i think NO), i should make another better driver hook, and also RE-verify if work!
Post 03 Nov 2008, 12:36
View user's profile Send private message Send e-mail Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17279
Location: In your JS exploiting you and your system
revolution
Hey Pirata Derek, how about using the edit function if you want to update your posting. This board is not a blog.
Post 03 Nov 2008, 12:37
View user's profile Send private message Visit poster's website Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Please, let me get more confidence with theese boards! I'm not registred from so looong time like you, no?
Post 03 Nov 2008, 13:30
View user's profile Send private message Send e-mail Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2, 3  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.