I have a few short questions regarding PG Timer analysis I would appreciate it a lot if you could show yourself open to talk :)
I was spending quiet some time reverse engineereing the encryption mechanism of the DPC-Addresses and was able to succesfully decrypt them, though I am still stuck, since my traversal through the KTIMER_TABLE-Struct results in much less KTIMER-Objects then I would obtain by issuing in example the '!timer'-command inside of a WinDbg Session.
Furthermore I would like to ask you something about the way you achieve to disable PG.
I simply assume that it could be enough to patch the DueTime Part of the corresponding KTIMERs in order to prevent PGs execution. Though I am able to do this, after Patching ie. 'KiAttachProcess'-Address in order to trigger PG I still get BSOD', thus my question if it is about something more fundamentally wrong in the way I obtain KTIMER-Objects (to rewind since '!timer' yields more hits) or because it is simply not enough to patch the DueTime part of a Timer.
I hope to hear from you.
I have a few short questions regarding PG Timer analysis I would appreciate it a lot if you could show yourself open to talk :)
I was spending quiet some time reverse engineereing the encryption mechanism of the DPC-Addresses and was able to succesfully decrypt them, though I am still stuck, since my traversal through the KTIMER_TABLE-Struct results in much less KTIMER-Objects then I would obtain by issuing in example the '!timer'-command inside of a WinDbg Session.
Furthermore I would like to ask you something about the way you achieve to disable PG.
I simply assume that it could be enough to patch the DueTime Part of the corresponding KTIMERs in order to prevent PGs execution. Though I am able to do this, after Patching ie. 'KiAttachProcess'-Address in order to trigger PG I still get BSOD', thus my question if it is about something more fundamentally wrong in the way I obtain KTIMER-Objects (to rewind since '!timer' yields more hits) or because it is simply not enough to patch the DueTime part of a Timer.
I hope to hear from you.