Log in

View Full Version : Windows NT IDA scripts


Kayaker
September 24th, 2003, 17:36
These IDC files are likely of interest to those trying to map out their own NTOSKRNL. Perhaps [Yates] can find a home for them for us in his collection

Windows NT Status Codes
Windows NT Bug Codes
Windows NT IRQ Levels (IRQL)
MSVC Exception Record
Definition of EPROCESS
Definition of ETHREAD


other NT articles of interest:
NT4.H (Revision 005)
Flushing VDM memory
Enumerating Pseudo-FS objects (mailslots, pipes, etc)

http://www.alkor.ru/~00077500/kb/winnt.htm

Kayaker

[yAtEs]
September 25th, 2003, 07:37
oh cool, these are of great interest to me , i'll also take in these
files, feed and clothe them, im sure they will have a happy
life on my site.

yates.

volodya
September 25th, 2003, 13:14
Excellent. I also have some add-ons. Be prepared to check them out from wasm. Thanks, Kayaker - you are as informative as usual

doug
September 25th, 2003, 22:33
here's an updated ntstatus.idc that I created from the xp sp1 ddk. it contains around 350 more lines/definitions

the parsing code was under 30 lines of C.

-doug

edit:
"Sorry, your attachment could not be accepted because your administrator's attachment quota would be exceeded by 17124364 bytes. He/She has been notified of this."

Kayaker
September 25th, 2003, 23:48
Thanks for the updated script doug. I'm not sure what the attachment problem is, the current size limit is set at 1,048,576 bytes, so from the error message you got you must have been trying to upload an 18MB file?

Lol, OK we'll assume not, so there must be some other problem. The board has just been updated to VBulletin 3.0.0 Beta 7 (cheers and/or jeers to Woodmann/JMI), so there *may* be some problem with the attachments. We can run a few tests and bugcheck on that.

Cheers to all,
Kayaker

doug
September 26th, 2003, 14:50
the mention about "administrator's" quota... or is that just a generic error message..

anyone able to attach file(s)?

this file is a 13kb .zip

Kayaker
September 26th, 2003, 15:02
Quote:
[Originally Posted by doug]
anyone able to attach file(s)?


No attachments of any size seem possible right now, things look OK on the surface though so there's a buggy floating around somewhere... hang in there.

doug
September 27th, 2003, 18:12
attachments are fixed, so here's the file.

-doug