Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


windbg doesnt display data (or how to force windbg to display data )

raj_rraj_r Member - All Emails Posts: 983
i was checking some vpc hooks on ntoskrnl via !chkimg -d

i see vpc hooking lots of instructions (125 errors)

kd> !chkimg nt
0 errors : nt
kd> g
Breakpoint 0 hit
vpc_8042+0x2cdd:
f9897cdd 0f ???
kd> !chkimg nt
125 errors : nt (804d910c-804ef20c)

most of these hooks are in nt!ExAcquireSharedWaitForExclusive patching the
setinterrupt (sti) clearinterrupt(cli) and trampolines to vmsti, vmcli

804e9199-804e91a0 8 bytes - nt!ExAcquireSharedWaitForExclusive+ef
(+0x05)
[ c2 08 00 90 90 90 90 90:0f c7 c8 02 03 c2 08 00 ]

kd> u 804e9199
nt!ExAcquireSharedWaitForExclusive+0xef:
804e9199 0fc7c80203 vmsti
804e919e c20800 ret 8

following one such hook i find i'm not able to make windbg display data
though windbg executes the instruction without problem

can someone take a look and tell me if i have any way to see the
content that gets to eax before i hit p
in the following copy paste



kd> g
Breakpoint 2 hit
eax=818f0030 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24
edi=818f0030
eip=819b70bb esp=f60d3a4c ebp=f60d3a58 iopl=0 nv up ei ng nz na po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00000282
819b70bb 9c pushfd
kd> p
eax=818f0030 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24
edi=818f0030
eip=819b70bc esp=f60d3a48 ebp=f60d3a58 iopl=0 nv up ei ng nz na po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00000282
819b70bc 50 push eax
kd> p
eax=818f0030 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24
edi=818f0030
eip=819b70bd esp=f60d3a44 ebp=f60d3a58 iopl=0 nv up ei ng nz na po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00000282
819b70bd a1002040f7 mov eax,dword ptr ds:[F7402000h]
ds:0023:f7402000=????????
kd> dd poi(f7402000)
Memory access error at ')'
kd> dd f7402000
f7402000 ???????? ???????? ???????? ????????
f7402010 ???????? ???????? ???????? ????????
f7402020 ???????? ???????? ???????? ????????
f7402030 ???????? ???????? ???????? ????????
f7402040 ???????? ???????? ???????? ????????
f7402050 ???????? ???????? ???????? ????????
f7402060 ???????? ???????? ???????? ????????
f7402070 ???????? ???????? ???????? ????????
kd> !address f7402000
address f7402000 not found in any known Kernel Address Range ----
kd> .pagein f7402000
Pagein operations are only supported for user mode addresses due to
limitations in the memory manager
kd> p
eax=f75900c5 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24
edi=818f0030
eip=819b70c2 esp=f60d3a44 ebp=f60d3a58 iopl=0 nv up ei ng nz na po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00000282
819b70c2 8020fd and byte ptr [eax],0FDh
ds:0023:f75900c5=??
kd> dd eax
f75900c5 ???????? ???????? ???????? ????????
f75900d5 ???????? ???????? ???????? ????????
f75900e5 ???????? ???????? ???????? ????????
f75900f5 ???????? ???????? ???????? ????????
f7590105 ???????? ???????? ???????? ????????
f7590115 ???????? ???????? ???????? ????????
f7590125 ???????? ???????? ???????? ????????
f7590135 ???????? ???????? ???????? ????????
kd> !address @eax
address f75900c5 not found in any known Kernel Address Range ----
kd> p
eax=f75900c5 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24
edi=818f0030
eip=819b70c5 esp=f60d3a44 ebp=f60d3a58 iopl=0 nv up di pl nz na po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00000002
819b70c5 80642405fd and byte ptr [esp+5],0FDh
ss:0010:f60d3a49=02
kd> dd eax
f75900c5 ???????? ???????? ???????? ????????
f75900d5 ???????? ???????? ???????? ????????
f75900e5 ???????? ???????? ???????? ????????
f75900f5 ???????? ???????? ???????? ????????
f7590105 ???????? ???????? ???????? ????????
f7590115 ???????? ???????? ???????? ????????
f7590125 ???????? ???????? ???????? ????????
f7590135 ???????? ???????? ???????? ????????

wishing everyone a happy year ahead
regards

raj_r

Comments

  • Ken_JohnsonKen_Johnson Member - All Emails Posts: 1,559
    What's !pte say?

    ? S

    ________________________________
    From: raj_r
    Sent: Thursday, January 01, 2009 10:54
    To: Kernel Debugging Interest List
    Subject: [windbg] windbg doesnt display data (or how to force windbg to display data )

    i was checking some vpc hooks on ntoskrnl via !chkimg -d

    i see vpc hooking lots of instructions (125 errors)

    kd> !chkimg nt
    0 errors : nt
    kd> g
    Breakpoint 0 hit
    vpc_8042+0x2cdd:
    f9897cdd 0f ???
    kd> !chkimg nt
    125 errors : nt (804d910c-804ef20c)

    most of these hooks are in nt!ExAcquireSharedWaitForExclusive patching the setinterrupt (sti) clearinterrupt(cli) and trampolines to vmsti, vmcli

    804e9199-804e91a0 8 bytes - nt!ExAcquireSharedWaitForExclusive+ef (+0x05)
    [ c2 08 00 90 90 90 90 90:0f c7 c8 02 03 c2 08 00 ]

    kd> u 804e9199
    nt!ExAcquireSharedWaitForExclusive+0xef:
    804e9199 0fc7c80203 vmsti
    804e919e c20800 ret 8

    following one such hook i find i'm not able to make windbg display data
    though windbg executes the instruction without problem

    can someone take a look and tell me if i have any way to see the content that gets to eax before i hit p
    in the following copy paste



    kd> g
    Breakpoint 2 hit
    eax=818f0030 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24 edi=818f0030
    eip=819b70bb esp=f60d3a4c ebp=f60d3a58 iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
    819b70bb 9c pushfd
    kd> p
    eax=818f0030 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24 edi=818f0030
    eip=819b70bc esp=f60d3a48 ebp=f60d3a58 iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
    819b70bc 50 push eax
    kd> p
    eax=818f0030 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24 edi=818f0030
    eip=819b70bd esp=f60d3a44 ebp=f60d3a58 iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
    819b70bd a1002040f7 mov eax,dword ptr ds:[F7402000h] ds:0023:f7402000=????????
    kd> dd poi(f7402000)
    Memory access error at ')'
    kd> dd f7402000
    f7402000 ???????? ???????? ???????? ????????
    f7402010 ???????? ???????? ???????? ????????
    f7402020 ???????? ???????? ???????? ????????
    f7402030 ???????? ???????? ???????? ????????
    f7402040 ???????? ???????? ???????? ????????
    f7402050 ???????? ???????? ???????? ????????
    f7402060 ???????? ???????? ???????? ????????
    f7402070 ???????? ???????? ???????? ????????
    kd> !address f7402000
    address f7402000 not found in any known Kernel Address Range ----
    kd> .pagein f7402000
    Pagein operations are only supported for user mode addresses due to limitations in the memory manager
    kd> p
    eax=f75900c5 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24 edi=818f0030
    eip=819b70c2 esp=f60d3a44 ebp=f60d3a58 iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
    819b70c2 8020fd and byte ptr [eax],0FDh ds:0023:f75900c5=??
    kd> dd eax
    f75900c5 ???????? ???????? ???????? ????????
    f75900d5 ???????? ???????? ???????? ????????
    f75900e5 ???????? ???????? ???????? ????????
    f75900f5 ???????? ???????? ???????? ????????
    f7590105 ???????? ???????? ???????? ????????
    f7590115 ???????? ???????? ???????? ????????
    f7590125 ???????? ???????? ???????? ????????
    f7590135 ???????? ???????? ???????? ????????
    kd> !address @eax
    address f75900c5 not found in any known Kernel Address Range ----
    kd> p
    eax=f75900c5 ebx=818f0030 ecx=818e3000 edx=0012019f esi=81ab0c24 edi=818f0030
    eip=819b70c5 esp=f60d3a44 ebp=f60d3a58 iopl=0 nv up di pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000002
    819b70c5 80642405fd and byte ptr [esp+5],0FDh ss:0010:f60d3a49=02
    kd> dd eax
    f75900c5 ???????? ???????? ???????? ????????
    f75900d5 ???????? ???????? ???????? ????????
    f75900e5 ???????? ???????? ???????? ????????
    f75900f5 ???????? ???????? ???????? ????????
    f7590105 ???????? ???????? ???????? ????????
    f7590115 ???????? ???????? ???????? ????????
    f7590125 ???????? ???????? ???????? ????????
    f7590135 ???????? ???????? ???????? ????????

    wishing everyone a happy year ahead
    regards

    raj_r


    --- You are currently subscribed to windbg as: [email protected]lalegends.com To unsubscribe send a blank email to [email protected]
  • raj_rraj_r Member - All Emails Posts: 983
    On 1/2/09, Skywing wrote:
    >
    > What's !pte say?
    >
    > ? S
    >


    the output of pte and pfn commands are at the end of this session paste ken
    thanks for replying (also a hardware bp doesnt seem to work as well)





    Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Waiting for pipe \\.\pipe\debugPipe
    Waiting to reconnect...
    Connected to Windows XP 2600 x86 compatible target at (Fri Jan 2
    21:55:54.359 2009 (GMT+5)), ptr64 FALSE
    Kernel Debugger connection established.
    Symbol search path is: SRV*F:\SYMBOLS*
    HTTP://MSDL.MICROSOFT.COM/DOWNLOAD/SYMBOLS
    Executable search path is:
    Windows XP Kernel Version 2600 UP Free x86 compatible
    Built by: 2600.xpsp_sp2_rtm.040803-2158
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
    System Uptime: not available
    Break instruction exception - code 80000003 (first chance)
    nt!DbgBreakPoint:
    804e3b14 cc int 3
    *kd> bp vpc_8042+0x2cdd;g;!chkimg nt;u 804d9545 l3;ba w1 804d9545;g;!chkimg
    nt;u 804d9545 l3;bp 804d9545;g;g
    *Bp expression 'vpc_8042+0x2cdd' could not be resolved, adding deferred bp
    Breakpoint 0 hit
    *** ERROR: Module load completed but symbols could not be loaded for
    vpc-8042.sys
    0 errors : nt
    nt!ExAcquireResourceSharedLite+0x10:
    804d9545 fa cli
    804d9546 8b7508 mov esi,dword ptr [ebp+8]
    804d9549 33db xor ebx,ebx
    ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 5
    ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 5
    ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 5
    Breakpoint 0 hit
    125 errors : nt (804d910c-804ef20c)
    nt!ExAcquireResourceSharedLite+0x10:
    804d9545 e91b474c01 jmp 8199dc65
    804d954a cc int 3
    804d954b 66395e0c cmp word ptr [esi+0Ch],bx
    Breakpoint 0 hit
    Breakpoint 2 hit
    nt!ExAcquireResourceSharedLite+0x10:
    804d9545 e91b474c01 jmp 8199dc65
    kd> p
    8199dc65 e967240200 jmp 819c00d1
    kd> p
    819c00d1 9c pushfd
    kd> p
    819c00d2 50 push eax
    kd> p
    819c00d3 a1002040f7 mov eax,dword ptr ds:[F7402000h]
    kd> dd F7402000 l4
    f7402000 ???????? ???????? ???????? ????????
    kd> dd poi(F7402000)
    Memory access error at ')'
    kd> !address F7402000
    address f7402000 not found in any known Kernel Address Range ----
    *kd> !pte F7402000
    VA f7402000
    PDE at C0300F74 PTE at C03DD008
    contains 0100D163 contains 00000000
    pfn 100d -G-DA--KWEV *

    *kd> !pfn 100d
    PFN 0000100D at address 81047138
    flink 00000000 blink / share count 00000002 pteaddress C0300F74
    reference count 0001 Cached color 0
    restore pte 00000000 containing page 000039 Active *

    thanks and regards

    raj_r

    * *
  • raj_rraj_r Member - All Emails Posts: 983
    ken do you happen to notice anything usable in the !pte and !pfn output
    any ideas

    thanks and regards

    raj



    On 1/2/09, raj_r wrote:
    >
    >
    >
    > On 1/2/09, Skywing wrote:
    >>
    >> What's !pte say?
    >>
    >> ? S
    >>
    >
    >
    > the output of pte and pfn commands are at the end of this session paste
    > ken
    > thanks for replying (also a hardware bp doesnt seem to work as well)
    >
    >
    >
    >
    >
    > Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    > Copyright (c) Microsoft Corporation. All rights reserved.
    >
    > Waiting for pipe \\.\pipe\debugPipe
    > Waiting to reconnect...
    > Connected to Windows XP 2600 x86 compatible target at (Fri Jan 2
    > 21:55:54.359 2009 (GMT+5)), ptr64 FALSE
    > Kernel Debugger connection established.
    > Symbol search path is: SRV*F:\SYMBOLS*
    > HTTP://MSDL.MICROSOFT.COM/DOWNLOAD/SYMBOLS
    > Executable search path is:
    > Windows XP Kernel Version 2600 UP Free x86 compatible
    > Built by: 2600.xpsp_sp2_rtm.040803-2158
    > Machine Name:
    > Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
    > System Uptime: not available
    > Break instruction exception - code 80000003 (first chance)
    > nt!DbgBreakPoint:
    > 804e3b14 cc int 3
    > *kd> bp vpc_8042+0x2cdd;g;!chkimg nt;u 804d9545 l3;ba w1 804d9545;g;!chkimg
    > nt;u 804d9545 l3;bp 804d9545;g;g
    > *Bp expression 'vpc_8042+0x2cdd' could not be resolved, adding deferred bp
    > Breakpoint 0 hit
    > *** ERROR: Module load completed but symbols could not be loaded for
    > vpc-8042.sys
    > 0 errors : nt
    > nt!ExAcquireResourceSharedLite+0x10:
    > 804d9545 fa cli
    > 804d9546 8b7508 mov esi,dword ptr [ebp+8]
    > 804d9549 33db xor ebx,ebx
    > ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 5
    > ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 5
    > ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 5
    > Breakpoint 0 hit
    > 125 errors : nt (804d910c-804ef20c)
    > nt!ExAcquireResourceSharedLite+0x10:
    > 804d9545 e91b474c01 jmp 8199dc65
    > 804d954a cc int 3
    > 804d954b 66395e0c cmp word ptr [esi+0Ch],bx
    > Breakpoint 0 hit
    > Breakpoint 2 hit
    > nt!ExAcquireResourceSharedLite+0x10:
    > 804d9545 e91b474c01 jmp 8199dc65
    > kd> p
    > 8199dc65 e967240200 jmp 819c00d1
    > kd> p
    > 819c00d1 9c pushfd
    > kd> p
    > 819c00d2 50 push eax
    > kd> p
    > 819c00d3 a1002040f7 mov eax,dword ptr ds:[F7402000h]
    > kd> dd F7402000 l4
    > f7402000 ???????? ???????? ???????? ????????
    > kd> dd poi(F7402000)
    > Memory access error at ')'
    > kd> !address F7402000
    > address f7402000 not found in any known Kernel Address Range ----
    > *kd> !pte F7402000
    > VA f7402000
    > PDE at C0300F74 PTE at C03DD008
    > contains 0100D163 contains 00000000
    > pfn 100d -G-DA--KWEV *
    >
    > *kd> !pfn 100d
    > PFN 0000100D at address 81047138
    > flink 00000000 blink / share count 00000002 pteaddress C0300F74
    > reference count 0001 Cached color 0
    > restore pte 00000000 containing page 000039 Active *
    >
    > thanks and regards
    >
    > raj_r
    >
    > * *
    >
    >
    >
    >
  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,356
    The PTE is invalid, the PFN that you show there is for the PDE. So, it would
    like as if the page is indeed invalid.

    I've never looked at VirtualPC before, any chance that address falls in the
    device memory range for some PCI device presented to the guest? I'd think
    you could still decode it from the debugger, but maybe not.

    -scott


    --
    Scott Noone
    Software Engineer
    OSR Open Systems Resources, Inc.
    http://www.osronline.com


    "raj_r" wrote in message news:[email protected]
    ken do you happen to notice anything usable in the !pte and !pfn output
    any ideas

    thanks and regards

    raj



    On 1/2/09, raj_r wrote:



    On 1/2/09, Skywing wrote:
    What's !pte say?

    – S


    the output of pte and pfn commands are at the end of this session paste ken
    thanks for replying (also a hardware bp doesnt seem to work as well)




    Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    Waiting for pipe \\.\pipe\debugPipe
    Waiting to reconnect...
    Connected to Windows XP 2600 x86 compatible target at (Fri Jan 2
    21:55:54.359 2009 (GMT+5)), ptr64 FALSE
    Kernel Debugger connection established.
    Symbol search path is:
    SRV*F:\SYMBOLS*HTTP://MSDL.MICROSOFT.COM/DOWNLOAD/SYMBOLS
    Executable search path is:
    Windows XP Kernel Version 2600 UP Free x86 compatible
    Built by: 2600.xpsp_sp2_rtm.040803-2158
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
    System Uptime: not available
    Break instruction exception - code 80000003 (first chance)
    nt!DbgBreakPoint:
    804e3b14 cc int 3
    kd> bp vpc_8042+0x2cdd;g;!chkimg nt;u 804d9545 l3;ba w1 804d9545;g;!chkimg
    nt;u 804d9545 l3;bp 804d9545;g;g
    Bp expression 'vpc_8042+0x2cdd' could not be resolved, adding deferred bp
    Breakpoint 0 hit
    *** ERROR: Module load completed but symbols could not be loaded for
    vpc-8042.sys
    0 errors : nt
    nt!ExAcquireResourceSharedLite+0x10:
    804d9545 fa cli
    804d9546 8b7508 mov esi,dword ptr [ebp+8]
    804d9549 33db xor ebx,ebx
    ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 5
    ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 5
    ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 5
    Breakpoint 0 hit
    125 errors : nt (804d910c-804ef20c)
    nt!ExAcquireResourceSharedLite+0x10:
    804d9545 e91b474c01 jmp 8199dc65
    804d954a cc int 3
    804d954b 66395e0c cmp word ptr [esi+0Ch],bx
    Breakpoint 0 hit
    Breakpoint 2 hit
    nt!ExAcquireResourceSharedLite+0x10:
    804d9545 e91b474c01 jmp 8199dc65
    kd> p
    8199dc65 e967240200 jmp 819c00d1
    kd> p
    819c00d1 9c pushfd
    kd> p
    819c00d2 50 push eax
    kd> p
    819c00d3 a1002040f7 mov eax,dword ptr ds:[F7402000h]
    kd> dd F7402000 l4
    f7402000 ???????? ???????? ???????? ????????
    kd> dd poi(F7402000)
    Memory access error at ')'
    kd> !address F7402000
    address f7402000 not found in any known Kernel Address Range ----
    kd> !pte F7402000
    VA f7402000
    PDE at C0300F74 PTE at C03DD008
    contains 0100D163 contains 00000000
    pfn 100d -G-DA--KWEV
    kd> !pfn 100d
    PFN 0000100D at address 81047138
    flink 00000000 blink / share count 00000002 pteaddress C0300F74
    reference count 0001 Cached color 0
    restore pte 00000000 containing page 000039 Active
    thanks and regards
    raj_r

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE