扩展SoftICE－－7

Chapter 8: Notes for Windows NT users
-------------------------------------


Windows NT does not support the dot commands interface.Anyway , there is a potential
method to extend kernel mode debuggers under NT through so-called bang commands.At least
Microsoft\'s Windeb can be extended in this way , I know nothing about NTICE at this time.
The method involves building some strange dynamic link libraries and them register
them from debugger\'s console.If NTICE supports this interface than we have a gold mine
because programing this kind of dll\'s is not so restrictive as programming VxD\'s and we
have much more \"high level\" exposed by Windows NT native API and ntoskernel.exe
Worth a investigation !



Appendix A: Some useful equates for VxD reverse engineering
-----------------------------------------------------------


SYS_CRITICAL_INIT 0000H
DEVICE_INIT 0001H
INIT_COMPLETE 0002H
SYS_VM_INIT 0003H
SYS_VM_TERMINATE 0004H
SYSTEM_EXIT 0005H
SYS_CRITICAL_EXIT 0006H
CREATE_VM 0007H
VM_CRITICAL_INIT 0008H
VM_INIT EQU 0009H
VM_TERMINATE 000AH
VM_NOT_EXECUTEABLE 000BH
DESTROY_VM 000CH
VM_SUSPEND 000DH
VM_RESUME 000EH
SET_DEVICE_FOCUS 000FH
BEGIN_MESSAGE_MODE 0010H
END_MESSAGE_MODE 0011H
REBOOT_PROCESSOR 0012H
QUERY_DESTROY 0013H
DEBUG_QUERY 0014H
BEGIN_PM_APP 0015H
END_PM_APP 0016H
DEVICE_REBOOT_NOTIFY 0017H
CRIT_REBOOT_NOTIFY 0018H
CLOSE_VM_NOTIFY 0019H
POWER_EVENT 001AH
SYS_DYNAMIC_DEVICE_INIT 001BH
SYS_DYNAMIC_DEVICE_EXIT 001CH
CREATE_THREAD 001DH
THREAD_INIT 001EH
TERMINATE_THREAD 001FH
THREAD_Not_Executeable 0020H
DESTROY_THREAD 0021H
PNP_NEW_DEVNODE 0022H
W32_DEVICEIOCONTROL 0023H



Appendix B: INT 22h - Win32 Protected mode interface requests API
-----------------------------------------------------------------

Int this appendix you will find some useful functions that Windows expose through INT 22h.You
can use this to gather data about diferent kernel objects, or to perform Win32 specific debug
operations.

AX=02h -- Converts a physical address to a linear address in curent context
 entry:
     ECX=phisycal address
 returns:
     ESI=linear address
     AX= 1 if success , otherwise 0
AX=07h -- Check to see if an address is within a VxD object
  entry:
     DS:ESI = buffer to receive object name
     BX  =  thread number
     EDX  = linear address to query
  returns:
     If EAX == 0, EDX = base address of object
     If EAX != 0, error  
AX=08h --  Get PDE for a specific context
   entry:
    BX = thread number
            EDX = linear address
   returns:
    if EAX == 0, ECX = PDE
    if EAX != 0, error
AX=0Ah --    Get LDT base
   entry:
    BX = thread number
   returns:
     if EAX == 0
     EDI = pointer to LDT
     ECX = LDT limit
     if EAX != 0, error


Credits (in alphabetic order)
-----------------------------

This time credits go to:

reverser, (aot) for hosting my documents :-)
+Mammon, for being a main +HCU backbone
Stone, United Cracking Force 98, (aot) for knowledge
+Undertaker, for
AfterDeath

To all others of you who asked my challenging questions , or gave useful idees,
      directly or in wonderful electronic disscussions.

Final notes
-----------

This document is providing \" as is \" whithout any warranties.It expose some potentialy
dangerous techniques.Incorect use of the interfaces presented may harm the OS integrity , causing
loose of data.Nor I , or reverser+, or any other Web_masters who may host this document and attached
source code  can be held responsable for anything this info or code do to you or your\'s machine.
The present document may not be modified whithout my express permission.Slightly editing
for correcting typos may be done in place , whithout permission from me.
Note that:
Masm 6 and Windows 95 DDK are trademarks of Microsoft Corporation
IDA is a trademark of Data Rescue company
SoftIce is a trademark of NuMega Technologies

You can contact me at ice_man81@hotmail.com\".Feedback is always apreciated.


--------------------------------------------------------------------------------