Low level WinNT debugger

1. read one books..<Debugging Applications>

2. read win2k souce code in windows/windbg/*/...

3. learn some driver dev....

ok.u can design one debugger named.....XSoftice??

[wenij]

I also suggest one good book.
"How debuggers Work",Wiley.
It tell you how the debugger works on windows and Unix .

I don't think Ring 0 code will help. It did back in Win9x, and that's how TRW2000 works. However, I still cannot find any alternatives to SoftICE for WinNT. The problem I see is that the people at NuMega/Compuware seems to know something about WindowsNT that is not published. I can write a low level driver that loads. However, it is not low enough because it can still be debugged by SoftICE! What I want is something that is in the same level at SoftICE, so I can see and maybe alter the loading process of Windows programmatically.

I also suggest one good book.
"How debuggers Work",Wiley.
It tell you how the debugger works on windows and Unix .

Who is the author? And more importantly, do you have a soft copy?

And does it tell you about low level debuggers, or just the application level ones (ie the ones written using the Windows Debugging API)

"Good start point iz learnig how icedump or iceext work from his source code .. "

I am unaware where you can get icedump or iceext's source code....

[N0P]

Originally Posted by auroras

Quote:
"Good start point iz learnig how icedump or iceext work from his source code .. "

I am unaware where you can get icedump or iceext's source code....

.. source code is included with exe file try search google for thiz ... or try search CrudeICE it iz free clone of softICe ... EDITED > it have source code included too < sorry thiz iz not true - big mistake, sorry

Sorry iam only human ;o))

[JMI]

auroras:

I don't think "contributing" a certain number of posts means dividing your response into 3 posts and posting part of it every two minutes. That is called padding your post count. I've made one post out of your comments and deleted the other two.

Regards,

Look for "Debugging Applications" by John Robbins. "Inside MS Windows 2000" by David A. Solomon and Mark E. Russinovich may help you.

SICE's core is a driver

[zEr0]

so then if SICE core is kernel driver i think that it can run under ring0 privileges

by u can find some useful thing about Ring mode in very useful virus ezines from 29A labs

http://29a.host.sk/

Intel manuals will be useful as well

SoftICE have at least two components ALL components load as standard
drivers:
1. siwvid.sys - mostly UI code load as SERVICE_BOOT_START driver

2. ntice.sys - SoftICE heart can load as SERVICE_BOOT_START but also
can load as SERVICE_SYSTEM_START or SERVICE_DEMAND_START drver

Most frequently ntice.sys configured as SERVICE_SYSTEM_START driver

3. Sometimes if ntice.sys load as SERVICE_BOOT_START it use third part:
siwsym.sys - SERVICE_BOOT_START driver where packed symbolic and config
info. This module used because in time when loaded SERVICE_BOOT_START drivers no file I/O services available (this drivers load by NTLDR).

P.S. Sorry for my poor english

Originally Posted by _kin_

SoftICE have at least two components ALL components load as standard
drivers:
1. siwvid.sys - mostly UI code load as SERVICE_BOOT_START driver

2. ntice.sys - SoftICE heart can load as SERVICE_BOOT_START but also
can load as SERVICE_SYSTEM_START or SERVICE_DEMAND_START drver

Most frequently ntice.sys configured as SERVICE_SYSTEM_START driver

3. Sometimes if ntice.sys load as SERVICE_BOOT_START it use third part:
siwsym.sys - SERVICE_BOOT_START driver where packed symbolic and config
info. This module used because in time when loaded SERVICE_BOOT_START drivers no file I/O services available (this drivers load by NTLDR).

P.S. Sorry for my poor english

Thank you for your reply.

Sorry if this is a dumb question, but if that is the case, what's stopping another driver from loading and debugging softice. Or is there nothing stopping that?

Originally Posted by auroras

Thank you for your reply.

Sorry if this is a dumb question, but if that is the case, what's stopping another driver from loading and debugging softice. Or is there nothing stopping that?

SoftICE has check to prevent debugging itself.

When it loaded (started), It patch some system parts (kernel, keyboard driver and so on) to get control over system. Also, as I know SoftICE change
system IDT and "virtualize" it - in debugger you see system IDT, but real IDT is hidden by SoftICE.

Originally Posted by _kin_

SoftICE has check to prevent debugging itself.

Also, as I know SoftICE change system IDT and "virtualize" it - in debugger you see system IDT, but real IDT is hidden by SoftICE.

Ahh...now I see

So is virtualising the IDT a function provided within the Kernel API, or is it some hack that SoftICE comes up with. I haven't come across any documentations on that.

In fact, when I posted a similar question on the Microsoft MSDN list, try to directly handle certain interrupts in a driver, I was told that it couldn't be done, and that it had to go through the IoConnectInterrupt().

Thanks

Sample IDT dump from Softice (w2k sp4)

0000  IntG32   0008:80466B36  DPL=0  P   ntoskrnl!Kei386EoiHelper+0590
0001  IntG32   0008:80466C86  DPL=3  P   ntoskrnl!Kei386EoiHelper+06E0
0002  IntG32   0008:0000145E  DPL=0  P
0003  IntG32   0008:80466F5E  DPL=3  P   ntoskrnl!Kei386EoiHelper+09B8
0004  IntG32   0008:804670C2  DPL=3  P   ntoskrnl!Kei386EoiHelper+0B1C
0005  IntG32   0008:80467206  DPL=0  P   ntoskrnl!Kei386EoiHelper+0C60
0006  IntG32   0008:8046736A  DPL=0  P   ntoskrnl!Kei386EoiHelper+0DC4
0007  IntG32   0008:80467903  DPL=0  P   ntoskrnl!Kei386EoiHelper+135D
0008  TaskG    0050:000014B8  DPL=0  P
0009  IntG32   0008:80467CBF  DPL=0  P   ntoskrnl!Kei386EoiHelper+1719
000A  IntG32   0008:80467DC7  DPL=0  P   ntoskrnl!Kei386EoiHelper+1821
000B  IntG32   0008:80467EF3  DPL=0  P   ntoskrnl!Kei386EoiHelper+194D
000C  IntG32   0008:804681F8  DPL=0  P   ntoskrnl!Kei386EoiHelper+1C52
000D  IntG32   0008:80468404  DPL=0  P   ntoskrnl!Kei386EoiHelper+1E5E
000E  IntG32   0008:80468E78  DPL=0  P   ntoskrnl!Kei386EoiHelper+28D2
000F  IntG32   0008:80469213  DPL=0  P   ntoskrnl!Kei386EoiHelper+2C6D

...and from my own descriptor table dumper:

#0000: 0000 [00000008:80466b36] * 32bit=1, gran=0, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#0001: 000b [00000008:b3fcd769] * 32bit=1, gran=1, present=1, dpl=3, type=[S] 32-bit Interrupt Gate      
#0002: 0010 [00000008:b3fcd778] * 32bit=1, gran=1, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#0003: 001b [00000008:b3fcd787] * 32bit=1, gran=1, present=1, dpl=3, type=[S] 32-bit Interrupt Gate      
#0004: 0023 [00000008:804670c2] * 32bit=1, gran=0, present=1, dpl=3, type=[S] 32-bit Interrupt Gate      
#0005: 0028 [00000008:80467206] * 32bit=1, gran=0, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#0006: 0030 [00000008:b3fcd796] * 32bit=1, gran=1, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#0007: 0038 [00000008:80467903] * 32bit=1, gran=0, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#0008: 0040 [00000050:000014b8] * 32bit=0, gran=0, present=1, dpl=0, type=[S] Task Gate                  
#0009: 0048 [00000008:80467cbf] * 32bit=1, gran=0, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#000a: 0050 [00000008:80467dc7] * 32bit=1, gran=0, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#000b: 0058 [00000008:b3fcd7a5] * 32bit=1, gran=1, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#000c: 0060 [00000008:b3fcd7b4] * 32bit=1, gran=1, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#000d: 0068 [00000008:b3fcd7c3] * 32bit=1, gran=1, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#000e: 0070 [00000008:b3fcd7d2] * 32bit=1, gran=1, present=1, dpl=0, type=[S] 32-bit Interrupt Gate      
#000f: 0078 [00000008:80469213] * 32bit=1, gran=0, present=1, dpl=0, type=[S] 32-bit Interrupt Gate

As you can clearly see, real values are NOT the one Softice shows you

http://www.sysinternals.com/ntw2k/freeware/debugview.shtml
http://www.sysinternals.com/files/dbgvnt.zip

DebugView is an application that lets you monitor debug output on your local system, or any computer on the network that you can reach via TCP/IP. It is capable of displaying both kernel-mode and Win32 debug output, so you don抰 need a debugger to catch the debug output your applications or device drivers generate, nor do you need to modify your applications or drivers to use non-standard debug output APIs.

DebugView works on Windows 95, 98, Me, NT 4, 2000, XP and .NET Server.
DebugView Capture


Under Windows 95, 98, and Me DebugView will capture output from the following sources:
Win32 OutputDebugString
Win16 OutputDebugString
Kernel-mode Out_Debug_String
Kernel-mode _Debug_Printf_Service
Under Windows NT, 2000, XP and .NET Server DebugView will capture:
Win32 OutputDebugString
Kernel-mode DbgPrint
All kernel-mode variants of DbgPrint implemented in Windows XP and .NET Server
DebugView also extracts kernel-mode debug output generated before a crash from Window NT/2000/XP crash dump files if DebugView was capturing at the time of the crash.