Advanced Debugging Tools

OllyDbg (V2.1) - This tool is mostly for examining malware and programs. I find the tool really useful, the Assembly is very good too, especially with tracing JMPs.


Download - OllyDbg 2.0

Hook Analyser (2.6) - Able to view application crashes with more detail, and hook onto running processes for malware analysis and debugging.




Download -  Hook Analyser Blog

WinCheck (8.50) - Able to view Kernel Data Structures not available in WinDbg.

Documentation - WinCheck Blog

Download - WinCheck KernelMode.Info forum

Comments

Post a Comment

Popular posts from this blog

Debugging Stop 0x124 - Using !whea

Image
A new month, a new post and a old topic. It's back to the Stop 0x124 once again, and this time I'm going to explain the !whea extension, which outputs the high level structure of the WHEA architecture. You'll need at least a Kernel Memory dump to use this extension. Take into account the current error record address for the WHEA_ERROR_RECORD structure, and the error source notified. We can actucally view the data structure with the dt nt!_(name) command, I've added the -r switch to dump all the substructures too; here is a partial output: Here is the !whea output. I've highlighted the address of the current WHEA_ERROR_RECORD present in our dump file, as the main error record for the crash. I've highlighted the source of the error, and the type of hardware platform which the error record falls under. We can see that one error has caused a bugcheck, and the rest are corrected errors. The rest of the !whea output is below: Let's explain what each of these fi...
Read more

Debugging Stop 0x1A - Out of Sync PFNs and Page Tables

Image
I've seen this bugcheck and it's parameter 403, becoming more common recently, and therefore thought I would share how I go around debugging the problem. Stop 0x1As rarely tell us what the parameters actually indicate and substitute to, therefore we need to check some documentation provided by Microsoft on their WDK (Windows Driver Kit) on MSDN. Stop 0x1A Documentation - Bug Check 0x1A: MEMORY_MANAGEMENT "The page table and PFNs are out of sync . This is probably a hardware error, especially if parameters 3 & 4 differ by only a single bit." The above is the meaning for the first parameter of 403, remember to always check the first parameter, the other parameters are usually meaningless unless you probably work for Microsoft. So, in this example, we need to examine the binary representation of the two parameters and then compare their bits. We can use the .formats command to examine and compare the two parameters together like so:  The parameters differ greatly...
Read more

Virtual Address Descriptors (VADs) - !vad

Image
Virtual Address Descriptors can provide useful information about the address space of a specified process. They provide information about the PTE Protection Bits, inheritance of the page and wherever the page is being shared among between processes ( section object ). VAD Trees are based upon a programming algorithm called a AVL Tree, an example and explanation of one can be found here on Sysnative .  Extension The root of the VAD tree can be found using the !process extension. The VADs field indicates the number of VADs or nodes within the AVL Tree. The AVL Tree is essentially the VAD Tree. The far right column indicates the PTE protection bits, and the next column indicates the page state. The last or first arrow (depending on how you look at it), shows the depth of the VAD within the VAD Tree. The Start and End fields indicate the memory range.  At the bottom of the VAD tree, you'll always see the above line, it indicates the total number of VADs within the VAD Tree and p...
Read more