A forum for reverse engineering, OS internals and malware analysis 

Discussion on reverse-engineering and debugging.
 #13688  by Tigzy
 Mon Jun 04, 2012 6:07 am
Ok, anyway this is new at least for me :)
Just one question. When jumping to KiDebugRoutine, how the filter know where it comes from, and get the args back?
 #13700  by Alex
 Mon Jun 04, 2012 3:32 pm
Here is the mentioned PoC - Single Byte Hooks. A short description how to use KiDebugRoutine in other way.
Just take look at parameters passed to KdpStub/KdpTrap and you will see what information you can extract from them - part of NGdbg kernel debugger:
Code: Select all
DbgTrap (
    IN PKTRAP_FRAME TrapFrame,
    IN PKEXCEPTION_FRAME ExceptionFrame,
    IN PEXCEPTION_RECORD ExceptionRecord,
    IN PCONTEXT ContextRecord,
    IN KPROCESSOR_MODE PreviousMode,
    IN BOOLEAN SecondChance