SoftICE crashing on Windows 2003

It seems like I'm a bit too stupid to use LiveKD. I did the following:

• Download and install the Windows 32-bit debugging tools
• Download LiveKD and copy it into the debugging tools folder.
• Configure the symbol path in WinDBG.
• Start LiveKD by running File->Kernel Debug->Local
• Open register, memory and disassembly windows from the menu

Then I had a command line (perfix: "lkd>") where I could enter my commands. I called "?" to list me the available commands

First I tried to show what's located at "fs:[124]" by entering "d fs:124", but I only got the message "GetContextState failed, 0x80004001" three times followed by "bad segment error at '124'.

Next I only entered "d 124" and got a memory dump, but only filled with "??" as data.

After that I read the help file entry for the "d" command to learn all possible "dump" commands and their correct syntax, but none of them worked, even the dump commands for psysical memory failed.

So how should I read "fs:[124]" from Ring-0 with WinDBG?

[deroko]

gdt from softice

:gdt
...
0030  Data32    FFDFF000  00001FFF  0    P   RW <--- KPCR
003B  Data32    7FFDE000  00000FFF  3    P   RW <--- TEB

so to read address of fs:[124h] you should type

dd FFDFF000+124

when you get address you might wanna play with it a little bit with:

dt nt!_ETHREAD <address> and so on, to explore state of some interesting structures of system. I don't know if something changed on win2k3 but you can always use wARK to get gdt and you will get address of fs without a problem As I said maybe they have changed something in internal structures so maybe fs:[124] doesn't point to CurentThread, to be sure you should explore strucutres with:

dt nt!_structure (eg. dt nt!_KPCR, dt nt!_KPRCB etc...)

Regards

Now I'm completely confused. I installed WinXP and Win2003 on a different PC. I also installed SoftICE on both PCs. The interesing point is that SoftICE loads on WinXP and Win2003.

Then I checked the part where SoftICE on Win2003 crashes on the other PC from Ring-0. (the code from above)

On WinXP, [EAX+44] points to some other memory location, so [EAX+18] can be read normally.

On Win2003, [EAX+44] has a value of NULL, so reading [EAX+18] will crash the computer.

The code crashing my computer crashes it always on Windows 2003, but for some reason it is not executed on one of the PCs.

Both computers have a totally different hardware configuration (chipset, count and manufracturer of CPUs, installed RAM), but the software is the same (expect for the hardware drivers).

Has anybody some other idea what the source of the problem might be?

[taos]

Originally Posted by MarkusO

Has anybody some other idea what the source of the problem might be?

Syd (stripper author) has the same problem. He thinks that maybe because win2k3sp1 has anti-kernel-patching and his processor has EMT64 and (as I understand) supports this feature, so he has BSOD during kernel patching.

Maybe a patch for win2003...

As far as I know "Patch Guard" is only available in the x64 editions. MarkusO also wrote that it even crashes with SP0 installed, which 100% sure had no support for "Patch Guard" and "NX-Bit".

@MarkusO:
Can you post your hardware details so we might get behind the problem?