Log in

View Full Version : Debugger Rings


PTD
July 23rd, 2011, 01:54
What is the difference between a "ring 0" debugger and a "ring 3" debugger?
More specifically, do they serve different purposes for debugging?

evlncrn8
July 23rd, 2011, 04:24
Ring 0 debugger (softice, syser) is more 'powerful' than a ring 3 one as it can go deeper into the windows kernel, debugging drivers etc.
Ring 3 debuggers (ollydbg etc) can't debug into the kernel / drivers (will 'stop' tracing on int 2e or a syscall)..
Windbg is sort of in the middle as you can debug drivers with it but you require 2 pc's..
And this is a question you could have answered yourself with google.. (laying bait for the jmi to come)

PTD
July 23rd, 2011, 11:13
Thank you for the detailed explanation.
As for google, I had tried searching for the differences between the two and came up with nothing. Furthermore, I had searched the forums for any related topics hoping to find my answer and I found nothing as well. Please forgive my ignorance, I am just wanting to learn the art of reversing. I am trying to follow Fravia and ORC's tutorials, but they seem quite outdated as most of their targets and tools are not compatible with Windows 7 :-(

disavowed
July 23rd, 2011, 14:53
Quote:
[Originally Posted by PTD;90718]As for google, I had tried searching for the differences between the two and came up with nothing.


When I search on Google for:
ring 0 3

the first hit is for http://en.wikipedia.org/wiki/Ring_(computer_security), which explains what evlncrn8 said above.

PTD
July 23rd, 2011, 16:25
Quote:
[Originally Posted by disavowed;90720]When I search on Google for:
ring 0 3

the first hit is for http://en.wikipedia.org/wiki/Ring_(computer_security), which explains what evlncrn8 said above.


Code:
http://www.google.com/search?client=opera&rls=en&q=difference+between+ring+0+and+ring+3+debuggers&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest#hl=en&client=opera&hs=HvP&rls=en&channel=suggest&sa=X&ei=ZDsrTpG3KdGgtwfXvajXAg&ved=0CBMQBSgA&q=difference+between+ring+0+and+ring+3+debugger&spell=1&bav=on.2,or.r_gc.r_pw.&fp=c99a1973f6c67dac&biw=1280&bih=942

This is what came up for me. Please be more understanding. I knew nothing of the topic and was searching blindly for an answer. Our search perameters differ quite a bit.

Woodmann
July 23rd, 2011, 19:26
Howdy,

Start with Lena's tutorials. They are more recent.

Woodmann

PTD
July 23rd, 2011, 21:12
Quote:
[Originally Posted by Woodmann;90725]Howdy,

Start with Lena's tutorials. They are more recent.

Woodmann


I'm looking more towards essays. Lena's tutorials, while as good as they may be, are hard to follow especially with no voice over. Essays go into great detail and express opinion, which is what I long for in tutorials.