Practical Reverse Engineering Exercise Solutions: Windows Kernel Routines
I am currently developing my reverse engineering skills and want to keep some important parts of this journey as well in this blog.
The first step of this series relates to disassembling Windows kernel routines, in my case Windows 7.
What are the prerequisites for this exercise?
- Ideally, install Windows inside a virtual machine
- From Windows Vista onwards, the Kernel debugging mode has to be enabled with:
bcdedit /debug on
- Install Debugging Tools for Windows (for example, as part of the Windows SDK - https://www.microsoft.com/en-us/download/details.aspx?id=3138 for Windows 7, which contains the Kernel Debugger (KD))
- Install LiveKD from the SysInternals Suite
- IMPORTANT: the livekd.exe file should be placed in the system32 folder
Notice that since we use LiveKD, we are essentially debugging the Kernel locally without a second system. With this approach, functions cannot be debugged as LiveKD uses a Kernel read-only memory dump as a basis.
If you have any questions to the usage of KD, the best resource available to my knowledge is the Windows help file included with the Windows SDK, debugger.chm. It contains a plethora of information and is especially helpful for the command line usage. Searching is possible by using the command .hh and the command you are interested in as an argument. For example, .hh uf would display the help menu for the uf command.
In order to start the Kernel Debugger, open a command line prompt with administrative privileges and start the LiveKd executable, which will invoke the KD.exe included in the Windows SDK:
The Kernel Debugger has started successfully and we can proceed with our experiments.
Initially, we will disassemble the KeInitializeDpc Windows kernel routine, which is described in detail at: https://msdn.microsoft.com/en-us/library/windows/hardware/ff552130(v=vs.85).aspx
For obtaining the disassembly of this function, we will use the uf (unassemble function) command of the Kernel Debugger:
As mentioned on MSDN, the function transforms a (K)DPC object, which is
defined in the Windows kernel. The command for analyzing datatypes in KD
dt (display type).
I found two other blogs on the Internet that published their results as well. You should definitely have a look at them likewise: