what is your take on this
sysinternals livekd and latest windbgs local kernel debugging both are fake those are not debugging the system live.
they create a snapshot and provide various facets about the kernel state.
(yes it is quiet usefull under many circumstances .
I use the facility quiet often
have written a plugin for ollydbg to use the functionality inside ollydbg blah blah blah blah )
but both of them are not kernel debugging they are similar to
MRI or CAT or Sonograph or Endoscope seeing something without actually seeing it
hearing something without actually hearing and
feeling something without actually feeling them
yes you need two machines and a transport between them for windbg to work if you want to work with real hot iron
you can kinda fake this and perform a single machine kernel debugging if you don't have to work with hot iron
simply get and install one of the virtual (PC / ware / box / .....) (hereinafter called as target) in your laptop (hereinafter called as host)
install your favorite OS (preferably xp sp3 to start with) in the target
create a virtual transport using named-pipe between host and the target
open windbg in host and connect it the virtual transport send a break-in from host (ctrl+break) or from target (ctrl+alt+fn+prtscreen)
enjoy uninterrupted kdculation
read the articles they both exist for a reason bloat with garter-belt is not one of them
http://msdn.microsoft.com/en-in/library/windows/hardware/ff565438%28v=vs.85%29.aspx
http://www.osronline.com/article.cfm?id=257
should x api be called before y DDI in fist pose
windbg knows ntfs better than me
started a vpc - kd session
asked what windbg knows about ntfs,mft,read,write with
Code:
kd> x ntfs!*r*mft*r*
fc34fc03 Ntfs!NtfsReadMftRecord = <no type information>
fc3a3545 Ntfs!NtfsDefragMftPriv = <no type information>
fc36d2af Ntfs!NtfsReserveMftRecord = <no type information>
fc33cd0f Ntfs!NtfsReadMftExceptionFilter = <no type information>
set a log break on one of them and on nt!NtCreateFile and dumped the stack to examine it
a bit of googling and observation shows that the third argument to this call is MFT_SEGMENT_REFERANCE or FILE_REFERANCE
again a bit of googling says ntfswalk by dmitybyrant can show the mft details downloading and running it and spleunking a little with windbg
it seems i can narrow down mft reads and ntcreatefile
the script as used for logging mft reads and create file as follows
Code:
printdec.txt (ntfswalk shows mft# in decimal so
.printf "mft# = %6d\tFileName = %msu\n" , poi(poi(@esp+c)) , poi(poi(@esp+c)+20)+8 ;
gc
filepattern is last posts script
as /mu ${/v:instr} @@c++((wchar_t *)(((nt!_UNICODE_STRING *)((nt!_OBJECT_ATTRIBUTES *)@@masm(poi(@esp+c)))->ObjectName)->Buffer)) ;
.catch { .block { r $t0 = $spat( "${instr}", "*${$arg1}*" ) ; } } ;
.if (@$t0 !=1) {gc} .else {.echo matched ${instr} } ;
bps like below
kd> bl
0 e fc34fc03 0001 (0001) Ntfs!NtfsReadMftRecord "$$>a< printdec.txt"
1 e 8056cdc0 0001 (0001) nt!NtCreateFile "$$>a< filepattern.txt waxford"
and output on double clicking the waxford.txt file in vpc's Desktop till opening of the file in desktop
Code:
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
mft# = 2162 FileName = NOTEPAD.EXE
mft# = 87 FileName = APPPATCH
mft# = 29 FileName = SYSTEM32
mft# = 5 FileName = \
mft# = 28 FileName = WINDOWS
mft# = 29 FileName = SYSTEM32
mft# = 5 FileName = \
mft# = 28 FileName = WINDOWS
mft# = 29 FileName = SYSTEM32
mft# = 5 FileName = \
mft# = 28 FileName = WINDOWS
mft# = 29 FileName = SYSTEM32
mft# = 29 FileName = SYSTEM32
mft# = 29 FileName = SYSTEM32
mft# = 29 FileName = SYSTEM32
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 3700 FileName = X86_POLICY.6.0.MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_X-WW_5DDAD775
mft# = 28 FileName = WINDOWS
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
mft# = 10328 FileName = ADMIN
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\", "*waxford*" ) ; '
mft# = 5 FileName = \
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\DOCUMENTS AND SETTINGS\", "*waxford*" ) ; '
mft# = 3646 FileName = DOCUME~1
mft# = 3646 FileName = DOCUME~1
mft# = 10328 FileName = ADMIN
mft# = 10471 FileName = DESKTOP
mft# = 5 FileName = \
mft# = 3646 FileName = DOCUME~1
mft# = 10328 FileName = ADMIN
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\DOCUMENTS AND SETTINGS\ADMIN\", "*waxford*" ) ; '
mft# = 10455 FileName = LOCAL SETTINGS
mft# = 10328 FileName = ADMIN
mft# = 11678 FileName = WAXFORD.TXT.LNK
mft# = 11678 FileName = WAXFORD.TXT.LNK
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\DOCUMENTS AND SETTINGS\ADMIN\DESKTOP\", "*waxford*" ) ; '
mft# = 11673 FileName = CHANGE.LOG
mft# = 11673 FileName = CHANGE.LOG
mft# = 11638 FileName = RP7
mft# = 11678 FileName = WAXFORD.TXT.LNK
mft# = 10451 FileName = RECENT
mft# = 10471 FileName = DESKTOP
mft# = 0 FileName = $MFT
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\WINDOWS\", "*waxford*" ) ; '
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 10328 FileName = ADMIN
mft# = 28 FileName = WINDOWS
mft# = 10451 FileName = RECENT
matched \??\C:\Documents and Settings\admin\Desktop\waxford.txt
nt!NtCreateFile:
8056cdc0 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
f91a7d30 804de7ec 00c4dbb0 00100080 00c4db50 nt!NtCreateFile
f91a7d30 7c90e4f4 00c4dbb0 00100080 00c4db50 nt!KiFastCallEntry+0xf8
00c4db0c 7c90d09c 7c8109a6 00c4dbb0 00100080 ntdll!KiFastSystemCallRet
00c4db10 7c8109a6 00c4dbb0 00100080 00c4db50 ntdll!ZwCreateFile+0xc
00c4dba8 7ca2560d 00c4e0f4 00000080 00000007 kernel32!CreateFileW+0x35f
00c4dc0c 7ca254e4 00c4e0f4 00c4dc2c 00c4dc30 SHELL32!GetFindDataForPath+0x26
00c4de84 7ca252ee 00c4e0f4 60000000 00ad0084 SHELL32!CShellLink::_GetFindDataAndTracker+0x4c
00c4e300 7ca2ed9d 00ad0084 00000000 00000001 SHELL32!CShellLink::_SetPIDLPath+0x15f
00c4e314 7ca3074a 00153fc8 00ad0084 00ad0084 SHELL32!CShellLink::SetIDList+0x14
00c4e758 7ca30590 00ad0084 00c4e790 00c4e78c SHELL32!CreateLinkToPidl+0x178
00c4e99c 7ca3023d 00ad0084 00ad006c 00c4e9c4 SHELL32!CTaskAddDoc::_CreateMRUItem+0x5b
00c4e9c8 7ca2ffc3 00ad0084 00ad006c 00ad007a SHELL32!CTaskAddDoc::_AddDocToRecentAndExtRecent+0x55
00c4fe4c 7ca2fece 00ad0084 00ad001c 0014f3a0 SHELL32!CTaskAddDoc::_AddToRecentDocs+0xf6
00c4fe68 7c9f47ed 00ad0084 00111660 000d71d8 SHELL32!CTaskAddDoc::RunInitRT+0x69
00c4fe84 75f81b9a 0014f398 75f81b18 75f80000 SHELL32!CRunnableTask::Run+0x54
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c4fee0 77f69588 001612b0 00127e40 77f6956b 0x75f81b9a
00c4fef8 7c927aa2 00127e40 7c97b440 00127990 SHLWAPI!ExecuteWorkItem+0x1d
00c4ff40 7c927ae3 77f6956b 00127e40 0009cc50 ntdll!RtlpWorkerCallout+0x70
00c4ff60 7c927ba5 00000000 00127e40 00127990 ntdll!RtlpExecuteWorkerRequest+0x1a
00c4ff74 7c927b7c 7c927ac9 00000000 00127e40 ntdll!RtlpApcCallout+0x11
00c4ffb4 7c80b713 00000000 0007ccf4 0007ccf4 ntdll!RtlpWorkerThread+0x87
00c4ffec 00000000 7c910230 00000000 00000000 kernel32!BaseThreadStart+0x37
kd> g
mft# = 11672 FileName = WAXFORD.TXT
mft# = 25 FileName = $OBJID
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\WINDOWS\APPPATCH\", "*waxford*" ) ; '
matched \DEVICE\HARDDISKVOLUME1\WINDOWS\APPPATCH\
nt!NtCreateFile:
8056cdc0 8bff mov edi,edi
kd> al
Alias Value
------- -------
instr \DEVICE\HARDDISKVOLUME1\WINDOWS\APPPATCH\
mftfilename SOFTWARE.LOG
kd> ad *
kd> al
No aliases
kd> g
mft# = 25 FileName = $OBJID
Syntax error at '( "\??\C:\Documents and Settings\admin\Desktop\", "*waxford*" ) ; '
mft# = 10471 FileName = DESKTOP
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\", "*waxford*" ) ; '
mft# = 10471 FileName = DESKTOP
mft# = 10451 FileName = RECENT
mft# = 10451 FileName = RECENT
mft# = 29 FileName = SYSTEM32
matched \??\C:\Documents and Settings\admin\Recent\waxford.txt.lnk
nt!NtCreateFile:
8056cdc0 8bff mov edi,edi
kd> g
mft# = 10451 FileName = RECENT
mft# = 10451 FileName = RECENT
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\", "*waxford*" ) ; '
matched \DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\
nt!NtCreateFile:
8056cdc0 8bff mov edi,edi
kd> g
mft# = 10451 FileName = RECENT
mft# = 0 FileName = $MFT
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\", "*waxford*" ) ; '
matched \DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\
nt!NtCreateFile:
8056cdc0 8bff mov edi,edi
kd> al
Alias Value
------- -------
instr \DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\
kd> g
mft# = 11673 FileName = CHANGE.LOG
mft# = 11673 FileName = CHANGE.LOG
mft# = 11638 FileName = RP7
mft# = 11678 FileName = WAXFORD.TXT.LNK
Syntax error at '( "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\", "*waxford*" ) ; '
mft# = 11678 FileName = WAXFORD.TXT.LNK
mft# = 11678 FileName = WAXFORD.TXT.LNK
mft# = 3696 FileName = X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83
mft# = 10451 FileName = RECENT
mft# = 10535 FileName = NTUSER.DAT.LOG
mft# = 1944 FileName = SHELL32.DLL
mft# = 10328 FileName = ADMIN
mft# = 10455 FileName = LOCAL SETTINGS
mft# = 29 FileName = SYSTEM32
mft# = 87 FileName = APPPATCH
mft# = 11678 FileName = WAXFORD.TXT.LNK
mft# = 28 FileName = WINDOWS
mft# = 28 FileName = WINDOWS
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 28 FileName = WINDOWS
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 3700 FileName = X86_POLICY.6.0.MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_X-WW_5DDAD775
mft# = 28 FileName = WINDOWS
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 29 FileName = SYSTEM32
mft# = 29 FileName = SYSTEM32
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 3700 FileName = X86_POLICY.6.0.MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_X-WW_5DDAD775
mft# = 28 FileName = WINDOWS
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 4979 FileName = EN-US
mft# = 3665 FileName = POLICIES
mft# = 28 FileName = WINDOWS
mft# = 127 FileName = MANIFESTS
mft# = 28 FileName = WINDOWS
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 180 FileName = EN
mft# = 29 FileName = SYSTEM32
mft# = 3630 FileName = SOFTWARE.LOG
mft# = 5507 FileName = <Win32 error 0n30>
mft# = 3630 FileName = SOFTWARE.LOG
mft# = 5507 FileName = <Win32 error 0n30>
mft# = 10471 FileName = DESKTOP
matched \??\C:\Documents and Settings\admin\Desktop\waxford.txt
nt!NtCreateFile:
8056cdc0 8bff mov edi,edi
kd> kb
ChildEBP RetAddr Args to Child
f8f2fd30 804de7ec 0007fe0c 80100080 0007fdac nt!NtCreateFile
f8f2fd30 7c90e4f4 0007fe0c 80100080 0007fdac nt!KiFastCallEntry+0xf8
0007fd68 7c90d09c 7c8109a6 0007fe0c 80100080 ntdll!KiFastSystemCallRet
0007fd6c 7c8109a6 0007fe0c 80100080 0007fdac ntdll!ZwCreateFile+0xc
0007fe04 01004a0d 0100a900 80000000 00000003 kernel32!CreateFileW+0x35f
0007fedc 01002980 01000000 00000000 00020630 svchost!___PchSym_+0x741
0007ff1c 01007511 01000000 00000000 000a2332 svchost!RegQueryStringA+0x86
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007ffc0 7c817067 00150950 0007daf8 7ffd5000 0x1007511
0007fff0 00000000 0100739d 00000000 78746341 kernel32!BaseProcessStart+0x23
kd> bl
0 e fc34fc03 0001 (0001) Ntfs!NtfsReadMftRecord "$$>a< printdec.txt"
1 e 8056cdc0 0001 (0001) nt!NtCreateFile "$$>a< filepattern.txt waxford"
Bookmarks