Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows Kernel debugger doesn't properly pause execution #598

Open
0xFDFDFDFD opened this issue Jul 17, 2024 · 5 comments
Open

Windows Kernel debugger doesn't properly pause execution #598

0xFDFDFDFD opened this issue Jul 17, 2024 · 5 comments
Assignees
Labels
bug Something isn't working
Milestone

Comments

@0xFDFDFDFD
Copy link

The Windows Kernel debugger doesn't properly pause execution.
Because when we pause the execution and we execute the r command twice without unpausing, the content of the registers changes:
Screenshot_20240717_122731

The expected behavior should be like this in windbg:
Screenshot_20240717_122930
After breaking none of the values are changing.

@xusheng6 xusheng6 added this to the Frogstar milestone Jul 18, 2024
@xusheng6 xusheng6 added the bug Something isn't working label Jul 18, 2024
@xusheng6
Copy link
Member

Thx for letting me know about this bug, I will fix it ASAP

@xusheng6 xusheng6 self-assigned this Jul 18, 2024
@xusheng6
Copy link
Member

Per my testing, the target is properly stopped -- I tried to interact with the VM and the guest system hangs. Also, it seems only the first time when you run "r", you get a different value, the subsequent values are all the same. I will look into it further but this may not be a bug

@0xFDFDFDFD
Copy link
Author

Yes it is only the first time i get a different value. Also the RIP changes from nt!DbgBreakPointWithStatus to nt!HalProcessorIdle where it stays. This behavior only happens in the binary ninja debugger not when i debug the kernel with windbg. And its not only the r command also commands like dd @r8 or any other command are changing the state.

@xusheng6
Copy link
Member

Right, there is definitely something unusual going on, and I need to figure that out

@xusheng6
Copy link
Member

This may be related to #591

@xusheng6 xusheng6 modified the milestones: Frogstar, Gallifrey Sep 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants