Advanced Debugging Tools

OllyDbg (V2.1) - This tool is mostly for examining malware and programs. I find the tool really useful, the Assembly is very good too, especially with tracing JMPs.


Download - OllyDbg 2.0

Hook Analyser (2.6) - Able to view application crashes with more detail, and hook onto running processes for malware analysis and debugging.




Download -  Hook Analyser Blog

WinCheck (8.50) - Able to view Kernel Data Structures not available in WinDbg.

Documentation - WinCheck Blog

Download - WinCheck KernelMode.Info forum

Comments

Post a Comment

Popular posts from this blog

Windows Access Tokens - !token and _TOKEN

Image
Windows needs to ensure that untrusted code and untrusted users aren't accessing important areas of the operating system, and creating problems which would ultimately lead to a vast number of BSODs. Windows manages this through Access Tokens which are used to identify the security context of a process/thread and a user. Access Tokens take two main forms: a Primary access token and a Impersonation access token. The Access Token additionally has two important features which are integral to security validation: SIDs (Security Identifiers) and a Privilege Array which contains the privileges allowed for that object. The token type can be found within a enumeration called TOKEN_TYPE.   The data structure can be found under the TokenType field within the _TOKEN structure. The Primary type determines the security context of the process for the currently logged on user, and the Impersonation type allows a thread to temporarily use a different security context. The Token type can also ...
Read more

Virtual Address Descriptors (VADs) - !vad

Image
Virtual Address Descriptors can provide useful information about the address space of a specified process. They provide information about the PTE Protection Bits, inheritance of the page and wherever the page is being shared among between processes ( section object ). VAD Trees are based upon a programming algorithm called a AVL Tree, an example and explanation of one can be found here on Sysnative .  Extension The root of the VAD tree can be found using the !process extension. The VADs field indicates the number of VADs or nodes within the AVL Tree. The AVL Tree is essentially the VAD Tree. The far right column indicates the PTE protection bits, and the next column indicates the page state. The last or first arrow (depending on how you look at it), shows the depth of the VAD within the VAD Tree. The Start and End fields indicate the memory range.  At the bottom of the VAD tree, you'll always see the above line, it indicates the total number of VADs within the VAD Tree and p...
Read more

Translation Lookaside Buffer (TLB) and Look Aside Lists

Image
TLB Cache The TLB Cache is very much a key part for the necessary performance of Virtual to Physical Address Translation. It's main purpose is to improve the performance of Virtual Address Translation. All modern CPUs and their MMUs (Memory Management Units) support the use of the TLB. A important aspect to understand, is the difference between TLB Hit and TLB Miss. When a Virtual Address is accessed, and then looked up, the TLB Cache is checked first to see if the Virtual-Physical Address mapping is present and if so then a TLB Hit occurs. On the other hand, if the address isn't present, then a TLB Miss occurs and the MMU is forced to execute a Page Walk which is the process of looking through the Page Tables like discussed in my previous blog posts. Once, the Page Walk has completed and the physical address is found, then this information is loaded into the TLB Cache. If Page Walk is unsuccessful, then a Page Fault is raised, and the Virtual to Physical Address Mapping is cre...
Read more