>!drvobj <드라이버 이름> //특정 드라이버 오브젝트의 포이터 주소를 이름으로 구하고자 할때 유용

ex)!drvobj atapi 3 //driver entry 및 dispatch routines 정보까지 나온다. 제일 좋음

>dt _driver_object <드라이버 오브젝트 포인터 주소> //드라이버에 대한 자세한 정보

//아래는 해당 정보도 볼 수 있다는 차원에서..

>dt _IRP

>dt _IO_STACK_LOCATION

>dt nt!SCSI_REQUEST_BLOCK //심볼이 없다..

>dt _DRIVER_OBJECT

>!irp FFBC9318 //??

>!devstack

>dt _list_entry

>x nt!KeServiceDescriptorTable //x 명령으로 N api 주소만 알고자 할 때 유용할 듯

8055c220 nt!KeServiceDescriptorTable = <no type information>

>uf nt!ZwMapViewOfSection //해당 함수의 어셈코드를 보여줌, 코드 패치되었나 확인할 때 유용

nt!ZwMapViewOfSection:

804def2c b86c000000      mov     eax,6Ch

804def31 8d542404        lea     edx,[esp+4]

...

>dds KeServiceDescriptorTable //dds 명령으로 이름을 같이 볼 수 있다.

8055c220  804e46a8 nt!KiServiceTable //N api list 포인터 주소

8055c224  00000000

8055c228  0000011c //N api list size

8055c22c  80512088 nt!KiArgumentTable

8055c230  00000000

8055c234  00000000

...

>dds 804e46a8 L11C //역시 dds 명령, L11C는 size(=>dds nt!KiServiceTable)

804e46a8  80591df5 nt!NtAcceptConnectPort

...

>lm d t //로드, 언로드된 모듈 리스트 정보

>ln CLASSPNP!ClassInternalIoControl //?

>ed 81b7dfac f99e0fc3 //메모리 변경 같음

추가..(2012-12)

>dt _object_type //

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES

14C machine (i386)

9 number of sections

4802539D time date stamp Mon Apr 14 03:40:29 2008

0 file pointer to symbol table

0 number of symbols

E0 size of optional header

10E characteristics

Executable

Line numbers stripped

Symbols stripped

32 bit word machine

OPTIONAL HEADER VALUES

10B magic #

7.10 linker version

14B80 size of code

2A00 size of initialized data

0 size of uninitialized data

159F7 address of entry point

380 base of code

----- new -----

80766000 image base

80 section alignment

80 file alignment

1 subsystem (Native)

5.01 operating system version

5.01 image version

5.01 subsystem version

17900 size of image

380 size of headers

1CD25 checksum

00040000 size of stack reserve

00001000 size of stack commit

00100000 size of heap reserve

00001000 size of heap commit

0 DLL characteristics

0 [ 0] address [size] of Export Directory

15A40 [ 50] address [size] of Import Directory

16780 [ 3E0] address [size] of Resource Directory

0 [ 0] address [size] of Exception Directory

0 [ 0] address [size] of Security Directory

16B80 [ C24] address [size] of Base Relocation Directory

B680 [ 1C] address [size] of Debug Directory

0 [ 0] address [size] of Description Directory

0 [ 0] address [size] of Special Directory

0 [ 0] address [size] of Thread Storage Directory

BE68 [ 40] address [size] of Load Configuration Directory

0 [ 0] address [size] of Bound Import Directory

B480 [ 1F4] address [size] of Import Address Table Directory

0 [ 0] address [size] of Delay Import Directory

0 [ 0] address [size] of COR20 Header Directory

0 [ 0] address [size] of Reserved Directory

SECTION HEADER #1

.text name

97BA virtual size

380 virtual address

9800 size of raw data

380 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

68000020 flags

Code

Not Paged

(no align specified)

Execute Read

.....

1. Prepare kernel debug using Windbg tool
2. menu - Debug - Event Filters.. -> Set the Load Module to 'enabled - not handle'
3. excute app
4. kd> kb -> check 4rd address from 'nt!DbgLoadImageSysbols 0x42' (It is 'ImageBase')
5. kd> !dh '4rd address('ImageBase')' -> check address of entry point
6. kd> u 'ImageBase' + 'entry point' -> bp 'DeviceControl address'

DeviceControl(MajorFunction[14]) 주소에 bp를 걸고 유저가 호출하는 코드를 따라간다.