What they want me to do ? Insert a custom debug code into kernel. However , making it to execute before NtMain() was a bet I took with a firend , is not really necesary.
An ideea which crossed my mind now is to force ntldr to load another small loader via /kernel switch , instead of ntoskrnl
and use this small snipet of code to . With a bit a lack , then I might be able to map myself the real kernel , and call the
entry point of my module. This will require some osloader hacking , but Ill try it to doit completly runtime. I hope to erase
“nope , cant do that” assumption. Lets hope Ill manage too.
The boot ideea is good too , but it would require me to write a hughe ammount of virtualization code , so the protected mode osloader would run under my own “virtual machine” monitor.
Thx to all who throwed their ideeas in.
----- Original Message -----
From: Moreira, Alberto
To: NT Developers Interest List
Sent: Friday, April 27, 2001 10:49 PM
Subject: [ntdev] Re: Very early module load
You can always frig the boot! Look at the LILO source code, that might give you some ideas.
Alberto
-----Original Message-----
From: Gary Little [mailto:xxxxx@Broadstor.com]
Sent: Friday, April 27, 2001 3:02 PM
To: NT Developers Interest List
Subject: [ntdev] Re: Very early module load
Dan,
Mark gave you the best answer so far. Sorry, but that is “nope, can’t do that”. At least not that way. what is it you want to do, or rather, what do the boys and girls in mahogany row want you to do?
Gary
-----Original Message-----
From: Dan Partelly [mailto:danp@jb.rdsor.ro]
Sent: Friday, April 27, 2001 10:41 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Very early module load
Thank you very much for you ideea , I apreciate it , but as I said — patching is not an option.
----- Original Message -----
From: Satish
To: NT Developers Interest List
Sent: Friday, April 27, 2001 3:04 PM
Subject: [ntdev] Re: Very early module load
Ur code no need to change for every build. Just Get the entry point by reading the header of PE and patch ur code. The only condition is u have to patch System File.
Regards,
Satish K.S
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com]On Behalf Of danp
Sent: Friday, April 27, 2001 5:20 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Very early module load
It is not an option. First , permanently patching a OS system file is unprofesional. Second , I need my code fully relocatable and to export an API trough standard PE export mechanism.
Third , II dont really wana adapt my code to every new build of ntoskrnl.
----- Original Message -----
From: Satish
To: NT Developers Interest List
Sent: Friday, April 27, 2001 11:51 AM
Subject: [ntdev] Re: Very early module load
Patch ur code into PE file. Then Update PE-File Entry point in Header to point to ur Code. U will get control first then return to original code.
Regards,
Satish K.S
----- Original Message -----
From: danp
To: NT Developers Interest List
Sent: Friday, April 27, 2001 1:56 PM
Subject: [ntdev] Very early module load
Hi ppl
Im looking to insert a PE module into system address space before any other OS modules , and execute it’s entry point. The main requirment is that the entry point of my module is executed before NtMain() from ntoskrnl. Any ideeas are apreciated.
Best regards , Dan
You are currently subscribed to ntdev as: xxxxx@aalayance.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: danp@jb.rdsor.ro
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: xxxxx@tellink.net
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: xxxxx@aalayance.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: danp@jb.rdsor.ro
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: xxxxx@delphieng.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: xxxxx@compuware.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: danp@jb.rdsor.ro
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com