Question

In the book “Rootkit Arsenal” page 84 (Chapter 3) mentions:

…, we can view the contents of the
target machine’s descriptor registers
using the command with the 0x100 mask:
kd> rM 0x100

and a paragraph below:

Note that the same task can be
accomplished by specifying the GDTR
components explicitly: kd> r gdtr ….

I run Windbg on my Win XP (inside VMWare) and choose the Kernel Debug -> Local.
My problem is in case of first command, windbg errors with:

lkd> rM 0x100
^ Operation not supported in current debug session ‘rM 0x100’

and in the second command:

lkd> r gdtr
^ Bad register error in ‘r gdtr’

Can anyone guide me ?

Answer 1

Right, you can’t look at registers in a local kernel debug session. LiveKD works and you can also get the address indirectly through the PCR (!pcr).

-scott