Hi there,
Platform: Windows XP
I have a USB PNP driver (i don;t have the code for the same) and I need to
disassemble it (as mentioned in my last query.) and require to see what all
data , function does it contain.
m using IDA PRo 4.5.1 for the same, trying it for the first time.I have a
few queries regarding the same:
- How should I load the driver, it shows three options:
a) portable executable for IBM
b) MS DOS executable
c) Binary file
Which option should i select ? Does this matter if i choose Binary file.
- I require exactly want to know how the driver is actually working,
data/functions used by it. How to go for the same.
Please send us your useful suggestions.
Thanks in advance,
Rohit
Following is the exact flow of my application:
- Upon starting user-level application , A request is sent to the driver
i.e PNP driver
- The driver fetches the request , processes it.
- For each such request, the driver queries a file, gets data from it, and
finally the driver sends the response back to user level application.
i.e Myuser.exe —(Sends password request) —>
MyDriver.sys ----(DriverReadsafile)---->File.dat ----(fileReturnsdatatodriver)—>Mydriver.sys----(sendspasswd)–>Myuser.exe
application
I want to check all the processing going at the “Driver level interacting
with the file” Unfortunately i don;t have the code for the driver.
So i need to dissassemble for driver part for the same.
Thanks in advance,
Rohit
“Rohit Dhamija” wrote in message
news:xxxxx@ntfsd…
> Hi there,
>
> Platform: Windows XP
> I have a USB PNP driver (i don;t have the code for the same) and I need to
> disassemble it (as mentioned in my last query.) and require to see what
> all data , function does it contain.
>
> m using IDA PRo 4.5.1 for the same, trying it for the first time.I have a
> few queries regarding the same:
>
> 1) How should I load the driver, it shows three options:
>
> a) portable executable for IBM
> b) MS DOS executable
> c) Binary file
>
> Which option should i select ? Does this matter if i choose Binary file.
>
> 2) I require exactly want to know how the driver is actually working,
> data/functions used by it. How to go for the same.
>
> Please send us your useful suggestions.
> Thanks in advance,
> Rohit
>
>
>
>
>
>
>
Sorry if it sounds rude:
- this list is surely not for IDA users.
- there are lists for IDA users (Appsec-Research aka IdaGeeks for
instance).
- There's the official forum in which you can become member as a
registered IDA user - should you not use a registered version you are
perhaps not welcome
http://www.datarescue.com/cgi-local/ultimatebb.cgi
- How should I load the driver, it shows three options:
a) portable executable for IBM
b) MS DOS executable
c) Binary file
- This shows you have not even basic knowledge. How do you want to
disassemble a driver if you cannot even write one? If you wrote one you
would know what was the output format, right?
Which option should i select ? Does this matter if i choose Binary file.
- Yes, it will be plain wrong. Binary is correct for COM-files, BIOS
images and other curiosities *g*
- I require exactly want to know how the driver is actually working,
data/functions used by it. How to go for the same.
- Study the DDK, study other internal functions and structures (Native
API Reference from Gary Nebbett), apply this knowledge to the IDA
database. Perhaps use some IDC which already contains enums and structs
needed.
Once more: move this discussion to an RE list/forum - neither of the OSR
lists deals with reverse engineering but instead with engineering (i.e.
developing drivers).
Oliver
--
May the source be with you, stranger 
ICQ: #281645
URL: http://assarbad.net
Forgot to tell: of course you need to choose the Portable Executable format.
As you would for any native executable on Windows NT++. IDA anyway offers
the best match already - usually this is correct unless you really know what
you want (say disassembling the DOS stub code).
BTW: My first version of IDA was also 4.51, so you should still be allowed
to upgrade to 4.7 (Build 831) with the latest patches for this
vulnerability:
http://www.datarescue.com/ubb/ultimatebb.php?/topic/2/146.html
Version 4.7 contains a Linux console version as well (and remote debugging
was also introduced meanwhile):
http://www.datarescue.com/idabase/idaupgrade.htm
Oliver
--
May the source be with you, stranger
ICQ: #281645
URL: http://assarbad.net
Sorry man,
but if you dont know so much, you dont stand a chanche to dissasemble a
driver,
and understand it. You lack the most elementary notions. You are light years
away from acomplishing your goal.
Dan
----- Original Message -----
From: “Rohit Dhamija”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Friday, February 04, 2005 11:16 AM
Subject: [ntfsd] IDA Pro help required!
> Hi there,
>
> Platform: Windows XP
> I have a USB PNP driver (i don;t have the code for the same) and I need to
> disassemble it (as mentioned in my last query.) and require to see what
> all data , function does it contain.
>
> m using IDA PRo 4.5.1 for the same, trying it for the first time.I have a
> few queries regarding the same:
>
> 1) How should I load the driver, it shows three options:
>
> a) portable executable for IBM
> b) MS DOS executable
> c) Binary file
>
> Which option should i select ? Does this matter if i choose Binary file.
>
> 2) I require exactly want to know how the driver is actually working,
> data/functions used by it. How to go for the same.
>
> Please send us your useful suggestions.
> Thanks in advance,
> Rohit
>
>
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Thanks Oliver,
My aim behind asking the below question was to get some info about the IDA
since this is the first time i am using a disassember although i know the
basics of developing devicedrivers and windows internals.
B/W Mr Partelly, is that necessary that a person needs to know disassember
tool before developing a device driver ???
Rohit
“Dan Partelly” wrote in message news:xxxxx@ntfsd…
> Sorry man,
>
> but if you dont know so much, you dont stand a chanche to dissasemble a
> driver,
> and understand it. You lack the most elementary notions. You are light
> years
> away from acomplishing your goal.
>
> Dan
>
> ----- Original Message -----
> From: “Rohit Dhamija”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Friday, February 04, 2005 11:16 AM
> Subject: [ntfsd] IDA Pro help required!
>
>
>> Hi there,
>>
>> Platform: Windows XP
>> I have a USB PNP driver (i don;t have the code for the same) and I need
>> to disassemble it (as mentioned in my last query.) and require to see
>> what all data , function does it contain.
>>
>> m using IDA PRo 4.5.1 for the same, trying it for the first time.I have
>> a few queries regarding the same:
>>
>> 1) How should I load the driver, it shows three options:
>>
>> a) portable executable for IBM
>> b) MS DOS executable
>> c) Binary file
>>
>> Which option should i select ? Does this matter if i choose Binary file.
>>
>> 2) I require exactly want to know how the driver is actually working,
>> data/functions used by it. How to go for the same.
>>
>> Please send us your useful suggestions.
>> Thanks in advance,
>> Rohit
>>
>>
>>
>>
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
No, of course. But asking what a NT dirver is , a binary file or a MS-DOS
file
shows a lot of holes in your knowledge.
----- Original Message -----
From: “Rohit Dhamija”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Friday, February 04, 2005 12:18 PM
Subject: Re:[ntfsd] IDA Pro help required!
> Thanks Oliver,
>
> My aim behind asking the below question was to get some info about the IDA
> since this is the first time i am using a disassember although i know the
> basics of developing devicedrivers and windows internals.
>
> B/W Mr Partelly, is that necessary that a person needs to know disassember
> tool before developing a device driver ???
> Rohit
>
>
> “Dan Partelly” wrote in message
> news:xxxxx@ntfsd…
>> Sorry man,
>>
>> but if you dont know so much, you dont stand a chanche to dissasemble a
>> driver,
>> and understand it. You lack the most elementary notions. You are light
>> years
>> away from acomplishing your goal.
>>
>> Dan
>>
>> ----- Original Message -----
>> From: “Rohit Dhamija”
>> Newsgroups: ntfsd
>> To: “Windows File Systems Devs Interest List”
>> Sent: Friday, February 04, 2005 11:16 AM
>> Subject: [ntfsd] IDA Pro help required!
>>
>>
>>> Hi there,
>>>
>>> Platform: Windows XP
>>> I have a USB PNP driver (i don;t have the code for the same) and I need
>>> to disassemble it (as mentioned in my last query.) and require to see
>>> what all data , function does it contain.
>>>
>>> m using IDA PRo 4.5.1 for the same, trying it for the first time.I have
>>> a few queries regarding the same:
>>>
>>> 1) How should I load the driver, it shows three options:
>>>
>>> a) portable executable for IBM
>>> b) MS DOS executable
>>> c) Binary file
>>>
>>> Which option should i select ? Does this matter if i choose Binary file.
>>>
>>> 2) I require exactly want to know how the driver is actually working,
>>> data/functions used by it. How to go for the same.
>>>
>>> Please send us your useful suggestions.
>>> Thanks in advance,
>>> Rohit
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> —
>>> Questions? First check the IFS FAQ at
>>> https://www.osronline.com/article.cfm?id=17
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com
No, i hope you took the question in the wrong sense.
I wanted to know exactly how the tool would respond if i tried to opened the
same in binary mode ?
Rohit
“Dan Partelly” wrote in message news:xxxxx@ntfsd…
> No, of course. But asking what a NT dirver is , a binary file or a MS-DOS
> file
> shows a lot of holes in your knowledge.
>
>
> ----- Original Message -----
> From: “Rohit Dhamija”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Friday, February 04, 2005 12:18 PM
> Subject: Re:[ntfsd] IDA Pro help required!
>
>
>> Thanks Oliver,
>>
>> My aim behind asking the below question was to get some info about the
>> IDA since this is the first time i am using a disassember although i know
>> the basics of developing devicedrivers and windows internals.
>>
>> B/W Mr Partelly, is that necessary that a person needs to know
>> disassember tool before developing a device driver ???
>> Rohit
>>
>>
>> “Dan Partelly” wrote in message
>> news:xxxxx@ntfsd…
>>> Sorry man,
>>>
>>> but if you dont know so much, you dont stand a chanche to dissasemble a
>>> driver,
>>> and understand it. You lack the most elementary notions. You are light
>>> years
>>> away from acomplishing your goal.
>>>
>>> Dan
>>>
>>> ----- Original Message -----
>>> From: “Rohit Dhamija”
>>> Newsgroups: ntfsd
>>> To: “Windows File Systems Devs Interest List”
>>> Sent: Friday, February 04, 2005 11:16 AM
>>> Subject: [ntfsd] IDA Pro help required!
>>>
>>>
>>>> Hi there,
>>>>
>>>> Platform: Windows XP
>>>> I have a USB PNP driver (i don;t have the code for the same) and I need
>>>> to disassemble it (as mentioned in my last query.) and require to see
>>>> what all data , function does it contain.
>>>>
>>>> m using IDA PRo 4.5.1 for the same, trying it for the first time.I
>>>> have a few queries regarding the same:
>>>>
>>>> 1) How should I load the driver, it shows three options:
>>>>
>>>> a) portable executable for IBM
>>>> b) MS DOS executable
>>>> c) Binary file
>>>>
>>>> Which option should i select ? Does this matter if i choose Binary
>>>> file.
>>>>
>>>> 2) I require exactly want to know how the driver is actually working,
>>>> data/functions used by it. How to go for the same.
>>>>
>>>> Please send us your useful suggestions.
>>>> Thanks in advance,
>>>> Rohit
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> —
>>>> Questions? First check the IFS FAQ at
>>>> https://www.osronline.com/article.cfm?id=17
>>>>
>>>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
Also, I guess this forum is to share/get the knowledge and not to point out
flaws in other. Don;t you feel that Inspite of pointing out mistakes, you
should have rather invested your and our time in sharing the knowledge.
Sorry, if am wrong.
Rohit
“Rohit Dhamija” wrote in message
news:xxxxx@ntfsd…
> No, i hope you took the question in the wrong sense.
> I wanted to know exactly how the tool would respond if i tried to opened
> the same in binary mode ?
> Rohit
>
> “Dan Partelly” wrote in message
> news:xxxxx@ntfsd…
>> No, of course. But asking what a NT dirver is , a binary file or a MS-DOS
>> file
>> shows a lot of holes in your knowledge.
>>
>>
>> ----- Original Message -----
>> From: “Rohit Dhamija”
>> Newsgroups: ntfsd
>> To: “Windows File Systems Devs Interest List”
>> Sent: Friday, February 04, 2005 12:18 PM
>> Subject: Re:[ntfsd] IDA Pro help required!
>>
>>
>>> Thanks Oliver,
>>>
>>> My aim behind asking the below question was to get some info about the
>>> IDA since this is the first time i am using a disassember although i
>>> know the basics of developing devicedrivers and windows internals.
>>>
>>> B/W Mr Partelly, is that necessary that a person needs to know
>>> disassember tool before developing a device driver ???
>>> Rohit
>>>
>>>
>>> “Dan Partelly” wrote in message
>>> news:xxxxx@ntfsd…
>>>> Sorry man,
>>>>
>>>> but if you dont know so much, you dont stand a chanche to dissasemble a
>>>> driver,
>>>> and understand it. You lack the most elementary notions. You are light
>>>> years
>>>> away from acomplishing your goal.
>>>>
>>>> Dan
>>>>
>>>> ----- Original Message -----
>>>> From: “Rohit Dhamija”
>>>> Newsgroups: ntfsd
>>>> To: “Windows File Systems Devs Interest List”
>>>> Sent: Friday, February 04, 2005 11:16 AM
>>>> Subject: [ntfsd] IDA Pro help required!
>>>>
>>>>
>>>>> Hi there,
>>>>>
>>>>> Platform: Windows XP
>>>>> I have a USB PNP driver (i don;t have the code for the same) and I
>>>>> need to disassemble it (as mentioned in my last query.) and require to
>>>>> see what all data , function does it contain.
>>>>>
>>>>> m using IDA PRo 4.5.1 for the same, trying it for the first time.I
>>>>> have a few queries regarding the same:
>>>>>
>>>>> 1) How should I load the driver, it shows three options:
>>>>>
>>>>> a) portable executable for IBM
>>>>> b) MS DOS executable
>>>>> c) Binary file
>>>>>
>>>>> Which option should i select ? Does this matter if i choose Binary
>>>>> file.
>>>>>
>>>>> 2) I require exactly want to know how the driver is actually working,
>>>>> data/functions used by it. How to go for the same.
>>>>>
>>>>> Please send us your useful suggestions.
>>>>> Thanks in advance,
>>>>> Rohit
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> —
>>>>> Questions? First check the IFS FAQ at
>>>>> https://www.osronline.com/article.cfm?id=17
>>>>>
>>>>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>>>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>>
>>>>
>>>
>>>
>>>
>>> —
>>> Questions? First check the IFS FAQ at
>>> https://www.osronline.com/article.cfm?id=17
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>
Yes that is correct but you’re off topic.
This thread is not related to nt file system filter driver development.
Plus you may find people are touchy about the subject of reverse
engineering.
Its illegal in some places.
BR,
Rob Linegar
Software Engineer
Data Encryption Systems Limited
www.des.co.uk | www.deslock.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Rohit Dhamija
Sent: 04 February 2005 10:32
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Re:IDA Pro help required!
Also, I guess this forum is to share/get the knowledge and not to point
out
flaws in other. Don;t you feel that Inspite of pointing out mistakes,
you
should have rather invested your and our time in sharing the knowledge.
Sorry, if am wrong.
Rohit
“Rohit Dhamija” wrote in message
news:xxxxx@ntfsd…
> No, i hope you took the question in the wrong sense.
> I wanted to know exactly how the tool would respond if i tried to
opened
> the same in binary mode ?
> Rohit
>
> “Dan Partelly” wrote in message
> news:xxxxx@ntfsd…
>> No, of course. But asking what a NT dirver is , a binary file or a
MS-DOS
>> file
>> shows a lot of holes in your knowledge.
>>
>>
>> ----- Original Message -----
>> From: “Rohit Dhamija”
>> Newsgroups: ntfsd
>> To: “Windows File Systems Devs Interest List”
>> Sent: Friday, February 04, 2005 12:18 PM
>> Subject: Re:[ntfsd] IDA Pro help required!
>>
>>
>>> Thanks Oliver,
>>>
>>> My aim behind asking the below question was to get some info about
the
>>> IDA since this is the first time i am using a disassember although i
>>> know the basics of developing devicedrivers and windows internals.
>>>
>>> B/W Mr Partelly, is that necessary that a person needs to know
>>> disassember tool before developing a device driver ???
>>> Rohit
>>>
>>>
>>> “Dan Partelly” wrote in message
>>> news:xxxxx@ntfsd…
>>>> Sorry man,
>>>>
>>>> but if you dont know so much, you dont stand a chanche to
dissasemble a
>>>> driver,
>>>> and understand it. You lack the most elementary notions. You are
light
>>>> years
>>>> away from acomplishing your goal.
>>>>
>>>> Dan
>>>>
>>>> ----- Original Message -----
>>>> From: “Rohit Dhamija”
>>>> Newsgroups: ntfsd
>>>> To: “Windows File Systems Devs Interest List”
>>>> Sent: Friday, February 04, 2005 11:16 AM
>>>> Subject: [ntfsd] IDA Pro help required!
>>>>
>>>>
>>>>> Hi there,
>>>>>
>>>>> Platform: Windows XP
>>>>> I have a USB PNP driver (i don;t have the code for the same) and I
>>>>> need to disassemble it (as mentioned in my last query.) and
require to
>>>>> see what all data , function does it contain.
>>>>>
>>>>> m using IDA PRo 4.5.1 for the same, trying it for the first time.I
>>>>> have a few queries regarding the same:
>>>>>
>>>>> 1) How should I load the driver, it shows three options:
>>>>>
>>>>> a) portable executable for IBM
>>>>> b) MS DOS executable
>>>>> c) Binary file
>>>>>
>>>>> Which option should i select ? Does this matter if i choose Binary
>>>>> file.
>>>>>
>>>>> 2) I require exactly want to know how the driver is actually
working,
>>>>> data/functions used by it. How to go for the same.
>>>>>
>>>>> Please send us your useful suggestions.
>>>>> Thanks in advance,
>>>>> Rohit
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> —
>>>>> Questions? First check the IFS FAQ at
>>>>> https://www.osronline.com/article.cfm?id=17
>>>>>
>>>>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>>>>> To unsubscribe send a blank email to
xxxxx@lists.osr.com
>>>>
>>>>
>>>
>>>
>>>
>>> —
>>> Questions? First check the IFS FAQ at
>>> https://www.osronline.com/article.cfm?id=17
>>>
>>> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@des.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com
> My aim behind asking the below question was to get some info about the
IDA since this is the first time i am using a disassember although i
know the basics of developing devicedrivers and windows internals.
Then you should be well off.
Just use the appropriate location to ask this question.
By the way: disassembling a driver (I did it multiple times) is not hard
until the driver size reaches several kB (I speak of non-WMI here). And then
there’s still the task to find out about undocumented structures and about
everything that’s defined by the programmer (own custom structs, functions,
IOCTLs and so on). I guess it’s more often a matter of practice than of
skills (until it comes to some curiosities).
B/W Mr Partelly, is that necessary that a person needs to know
disassember tool before developing a device driver ???
No, but knowledge how to use the debugger (and therefore some basics of RE
cannot be so wrong 
On Fri, 4 Feb 2005 10:38:41 -0000, Rob Linegar wrote:
> Plus you may find people are touchy about the subject of reverse
> engineering.
> Its illegal in some places.
I believe it’s not illegal per-se anywhere! I mean using a debugger already
is kind of RE and also if you lost the sources for a very old DOS program
from 198x and want to import the old format to a new program (given you hold
all rights).
Oliver
–
---------------------------------------------------
May the source be with you, stranger
ICQ: #281645
URL: http://assarbad.net
Hi,
Disassembling is also required when some hacker emulates your driver and
replaces it with its our own for various reasons. And this is what has
happened with one of our products. So was just trying to disassemble and
analysing what all the hacker’s driver has done.
I am in process of using IDA PRO to disassemble driver and have been able to
see the list of routines used in the driver.
Rohit
“Oliver Schneider” wrote in message
news:xxxxx@ntfsd…
>> My aim behind asking the below question was to get some info about the
>> IDA since this is the first time i am using a disassember although i
>> know the basics of developing devicedrivers and windows internals.
> Then you should be well off.
>
> Just use the appropriate location to ask this question.
> By the way: disassembling a driver (I did it multiple times) is not hard
> until the driver size reaches several kB (I speak of non-WMI here). And
> then
> there’s still the task to find out about undocumented structures and about
> everything that’s defined by the programmer (own custom structs,
> functions,
> IOCTLs and so on). I guess it’s more often a matter of practice than of
> skills (until it comes to some curiosities).
>
>> B/W Mr Partelly, is that necessary that a person needs to know
>> disassember tool before developing a device driver ???
> No, but knowledge how to use the debugger (and therefore some basics of RE
> cannot be so wrong
>
> On Fri, 4 Feb 2005 10:38:41 -0000, Rob Linegar wrote:
>> Plus you may find people are touchy about the subject of reverse
>> engineering.
>> Its illegal in some places.
> I believe it’s not illegal per-se anywhere! I mean using a debugger
> already
> is kind of RE and also if you lost the sources for a very old DOS program
> from 198x and want to import the old format to a new program (given you
> hold
> all rights).
>
> Oliver
>
> –
> ---------------------------------------------------
> May the source be with you, stranger
>
> ICQ: #281645
> URL: http://assarbad.net
>
lake_swan@163.com wrote:
if you want to dissassembled the dirver(a pe file),you may study may
undocument struct (like someone at above to say) in the kernel .i had do it
Can we just let this thread die? Please??
Peter
OSR
i will stop , : ) in here i am a beginner, and i just want to help someone.
thanks
“Peter Viscarola (OSR)” news:xxxxx@ntfsd…
> lake_swan@163.com wrote:
> > if you want to dissassembled the dirver(a pe file),you may study may
> > undocument struct (like someone at above to say) in the kernel .i had do
it
>
> Can we just let this thread die? Please??
>
> Peter
> OSR
>