February: Blog Post List

This is hopefully going to be the upcoming blog posts for February:
  • VTables and Virtual Functions
  • Thread Storage Slots
  • I/O Completion Ports
  • IRP Queues
  • PE Header Sections
  • Registry Internals
  • URBs and USB Internals
I'm also going to explore the I/O Manager more, since I haven't written much about it, and to be honest haven't read anything properly which is related to I/O for a while.


Comments

Post a Comment

Popular posts from this blog

Debugging Stop 0x1E - Finding the Exception Record Address in the Stack

Image
This is going to be a very short blog post, just to demonstrate how to find the Exception Record address in the stack, and how many times it seems to appear within the call stack. Interestingly, but not unsurprisingly, the exception code wasn't passed to any of the exception handlers in the call stack. The blue highlighting is the address of the exception record, and the green highlighting is the address of the trap frame which contains the last saved context. The !exchain extension shows all the exception handlers in the call stack. The _CONTEXT data structure can show us the saved registers from the trap frame. Please note I've omitted this data structure to the main registers.
Read more

Windows Access Tokens - !token and _TOKEN

Image
Windows needs to ensure that untrusted code and untrusted users aren't accessing important areas of the operating system, and creating problems which would ultimately lead to a vast number of BSODs. Windows manages this through Access Tokens which are used to identify the security context of a process/thread and a user. Access Tokens take two main forms: a Primary access token and a Impersonation access token. The Access Token additionally has two important features which are integral to security validation: SIDs (Security Identifiers) and a Privilege Array which contains the privileges allowed for that object. The token type can be found within a enumeration called TOKEN_TYPE.   The data structure can be found under the TokenType field within the _TOKEN structure. The Primary type determines the security context of the process for the currently logged on user, and the Impersonation type allows a thread to temporarily use a different security context. The Token type can also ...
Read more

Debugging Stop 0x9F - Power IRPs and PnP Manager

Image
You may have noticed or not have noticed with a few Stop 0x9F, the 0x4 value being the first parameter which indicates that a power IRP has failed to synchronize with the PnP Manager. The PnP Manager is a subsystem of the I/O Manager, and is used to allow devices to be added or removed without little interaction from the user. The best example to illustrate this point, would the insertion or removal of USB flash drives or any USB connected. The user will not have to install any additional drivers to use the device or configure any settings. The USB flash drive will almost instantaneously be added to the file system, and be able to managed by the user. This is a result of the design of the PnP Manager and the code used within the driver. The PnP Manager can't be directly interacted with any driver routines. The PnP Manager is both present in Kernel-Mode and User-Mode. The User-Mode version will interact with the Kernel-Mode version. The PnP Manager is also responsible for maintainin...
Read more