Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 06-24-2004, 02:46
DaGoN DaGoN is offline
Friend
 
Join Date: Jan 2004
Posts: 45
Rept. Given: 15
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 25
Thanks Rcvd at 18 Times in 7 Posts
DaGoN Reputation: 6
Ill bcome crazy with damn driver!

Why when i change a bit in this driver (w_w.ramdisk.tk) it doesnt start anymore?
1) driver is not signature
2) i've removed the installer (i deleted ramdisk.dll(<-- no crc check inside) from system32 and installer registry keys). Driver run.

this is driver entry method:
Quote:
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath)
{

push ebp
INIT:00018501 mov ebp, esp
INIT:00018503 push esi
INIT:00018504 mov esi, [ebp+arg_0]
INIT:00018507 lea eax, [ebp+arg_0]
INIT:0001850A push eax
INIT:0001850B push 10h
INIT:0001850D push offset start
INIT:00018512 push esi
INIT:00018513 call ds:IoAllocateDriverObjectExtension
INIT:00018519 test eax, eax
INIT:0001851B jl loc_185DA
INIT:00018521 mov ecx, [ebp+arg_0]
INIT:00018524 push edi
INIT:00018525 mov edi, [ebp+arg_4]
INIT:00018528 mov ax, [edi]
INIT:0001852B mov [ecx], ax
INIT:0001852E mov ax, [edi+2]
...
...
return
}
bp on IoAllocateDriverObjectExtension and sice break fine.
Now the things go bad:
When i change only one char in driver ramdisk.sys it doesnt run anymore(!?!?) and softice doesnt break anymore in driver entry point! Why?
There is any security check in windows kernel?
it seems that the system doesnt start it anymore because its changed...

Thx in adv,
DaGoN
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Driver patching / filter driver aldente General Discussion 4 03-21-2006 04:43


All times are GMT +8. The time now is 15:35.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )