Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Hi community!
I have a feeling that !reg extension works strange on my vm. So what I want is to get an immediate address of a key value. So I go through all the chores of !reg from getting KCB for the reg key, through dumping the kye hive etc, and eventually I get to the point where I have kvalue at hand:
` !reg valuelist 0xffff9782f04f6000 00000000028cf9ac
Dumping ValueList of Key <AeDebug> : [Idx] [ValAddr] [ValueName] [ 0] 00000000028cfa04 UserDebuggerHotKey [ 1] 00000000028cfa44 Debugger [ 2] 00000000028cfad4 Auto Use '!reg kvalue <ValAddr>' to dump the value !reg kvalue 00000000028cfa44 Signature: CM_KEY_VALUE_SIGNATURE (kv) Name : Debugger {compressed} DataLength: 6c Data : 28aea60 [cell index] Type : 1 !reg cellindex 0xffff9782f04f6000 28aea60 Map = ffff9782f0ff7000 Type = 0 Table = 14 Block = ae Offset = a60 MapTable = ffff9782f108b000 MapEntry = ffff9782f108c050 BinAddress = 00000000028cf001, BlockOffset = 0000000000000000 BlockAddress = 00000000028cf000 pcell: 00000000028cfa64
`
Now, that pcell doesn't look like a legitimate address does it? Needless to say when I try dumping it i get question marks of uncommitted memory.
Has anybody been there too? What do I do wrong?
Thank you!
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 16-20 October 2023 | Live, Online |
Developing Minifilters | 13-17 November 2023 | Live, Online |
Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
Writing WDF Drivers | 10-14 July 2023 | Live, Online |