3 ms·

> From what I can see the flag at [EAX+4] is somehow switched on when debugged. I wonder if a look into the leaked Windows kernel source code files (I _think_

> From what I can see the flag at [EAX+4] is somehow switched on when debugged. I wonder if a look into the leaked Windows kernel source code files (I _think_ the most current dump is still old Win2k?) could help out to decipher what these two RESERVED flags are used for? PEB_LDR_DATA still has them named as RESERVED1/2 [1]. [1] https://learn.microsoft.com/de-de/windows/win32/api/winternl/ns-winternl-peb_ldr_data https://learn.microsoft.com/de-de/windows/win32/api/winternl...

CSm1n 3y ago
It is a flag that says whether the loader data is initialized or not. The layout of PEB_LDR_DATA “leaked” long time ago in public PDBs. More context: It has nothing to do with debugging. However, if you attach to the process early enough, you might see the flag as 0 and eventually it would switch to 1. That is probably what threw him off.
- lukan 3y ago
  "you might see the flag as 0 and eventually it would switch to 1" Sorry, noob question: Were there easy avaiable tools (in the debugger), to monitor a variable like this and have the debugger stop exactly when it was going to change, so you could see which thread and function did it and why?
  - DaiPlusPlus 3y ago
    Yes, x86 kernel-mode debuggers support hardware breakpoints that cause the attached debugger (running on a separate machine, of course) to break not just when a specific address/instruction is executed, but also whenever some address is written to (and also possibly read-from too, I think?)
  - jasomill 3y ago
    Yes: many debuggers support setting watchpoints[1] that break on writes to a particular memory location. Depending on the platform and the debugger, these can be implemented using CPU architecture-specific debugging features, or in software, by single-step program execution and checking watched addresses for changes after each step. [1] https://sourceware.org/gdb/current/onlinedocs/gdb.html/Set-Watchpoints.html https://sourceware.org/gdb/current/onlinedocs/gdb.html/Set-W...
EMIRELADERO 3y ago
Help yourself: https://github.com/tongzx/nt5src/blob/daad8a087a4e75422ec96b7911f1df4669989611/Source/XPSP1/NT/public/sdk/inc/ntpsapi.h#L126 https://github.com/tongzx/nt5src/blob/daad8a087a4e75422ec96b...

CSm1n 3y ago

It is a flag that says whether the loader data is initialized or not. The layout of PEB_LDR_DATA “leaked” long time ago in public PDBs. More context: It has nothing to do with debugging. However, if you attach to the process early enough, you might see the flag as 0 and eventually it would switch to 1. That is probably what threw him off.

lukan 3y ago
"you might see the flag as 0 and eventually it would switch to 1" Sorry, noob question: Were there easy avaiable tools (in the debugger), to monitor a variable like this and have the debugger stop exactly when it was going to change, so you could see which thread and function did it and why?
- DaiPlusPlus 3y ago
  Yes, x86 kernel-mode debuggers support hardware breakpoints that cause the attached debugger (running on a separate machine, of course) to break not just when a specific address/instruction is executed, but also whenever some address is written to (and also possibly read-from too, I think?)
- jasomill 3y ago
  Yes: many debuggers support setting watchpoints[1] that break on writes to a particular memory location. Depending on the platform and the debugger, these can be implemented using CPU architecture-specific debugging features, or in software, by single-step program execution and checking watched addresses for changes after each step. [1] https://sourceware.org/gdb/current/onlinedocs/gdb.html/Set-Watchpoints.html https://sourceware.org/gdb/current/onlinedocs/gdb.html/Set-W...

EMIRELADERO 3y ago

Help yourself: https://github.com/tongzx/nt5src/blob/daad8a087a4e75422ec96b7911f1df4669989611/Source/XPSP1/NT/public/sdk/inc/ntpsapi.h#L126 https://github.com/tongzx/nt5src/blob/daad8a087a4e75422ec96b...