[everdox]

Hello gentlemen, first I would like to introduce myself. I have been learning about kernel development through school and have been looking for a decent community to be with, and this one looks pretty promising. I will try my best to always put forth educated material here and try to be somewhat of a contribution.

So I would like to say thanks to those of you in charge of this forum for creating a place for us to collaborate, share and learn.

I would like to open with a question, I am currently looking for a known method in WinDbg to find the thread id or even CID of a thread that caused an exception, an int3 to be precise.

Too get over this issue I have been writing a nasty trampoline hook to jump to my driver and retrieve the thread ID from the TEB.. but I need a real non hackerish method.

I am currently analyzing how sc.exe loads a driver into the system, so I have a breakpoint set up on NtLoadDriver (in ntoskrnl, not usermode ntdll of course). How can I see and or figure out the ID of the thread that hits here, I only know of !threads.. which enumerates all user and executive threads.

Thank you. :shock:

[rkhunter]

I would like to open with a question, I am currently looking for a known method in WinDbg to find the thread id or even CID of a thread that caused an exception, an int3 to be precise.

If you using windbg as a kernel debugger, int 3 exception will be break (wake up) windbg for user input.

I am currently analyzing how sc.exe loads a driver into the system, so I have a breakpoint set up on NtLoadDriver (in ntoskrnl, not usermode ntdll of course). How can I see and or figure out the ID of the thread that hits here, I only know of !threads.. which enumerates all user and executive threads.

"r @$thread" command gives you current thread addr or "r @$tid" gives it ID. If you need to see info about this thread, you may using "!thread -1" command, give you info about current thread. For example,

Code: Select all

bp nt!NtLoadDriver "r @$thread"

will be usefull.

[everdox]

great, thank you for the help rkhunter :D

is there a better source of information for windbg then the WDDK?

[newgre]

windbg.info is pretty good, especially the common commands site.