Kernel Mode

Assembly Challenge : Jump to a non-relative address without using registers

During developing a dispatch table for some instructions in binaries, one of the challenging problem which I faced, was changing the registers state in a way that doesn’t affect the program flow!

A first look at some aspects of Intel’s “Vanderpool” initiative

A few hours ago, I was working on Intel VT-x which enables a hardware support for virtualization then I saw the following slides which gives me lots of information about Hypervisor instructions,VMM, Virtual machine…

Fooling Windows about its internal CPU

In this post, I’m gonna show you how you can fool windows about its internal structure and sometimes give it wrong information about its internal capabilities or internal information which can bring you a lot of fun. (At least for me !)

Exploring from User-Mode to Kernel-Mode

There were times when I want to trace instructions from User Mode and continue tracing it into Kernel mode to reverse Windows’s internal implementation with my own supplied parameters from User Mode but there were a big problem and that was, How to access User…

Change User-Mode application’s virtual address through Kernel Debugging

Well, it’s somehow an odd topic but sometimes it could be really helpful in some situations.

So what are the situations?

How to get every details about SSDT , GDT , IDT in a blink of an eye

In a few days ago I was looking for something to show me the SSDT and GDT (Which is really important in malware analyzing because most of rootkits are interested in hooking and changing this stuffs.)

Kernel Mode Debugging by Windbg

Hey there,

Today I’m gonna show you how to make a kernel mode debugging using VMWare and Windbg and Windows.

So why should you do this ?!