Learning how Windows NT work

Done, i'd made a decision, there is a lot of documents around internet about windows, really i'm not going to write the same thing here, and even if i write about the kernel, first, i'll need to explain things that we need to know before we go(that blog is not intent to "experts" as you see, i give my attention for who is starting), so if i think that is necessary write somethings, i'll do.

So, anyway here is a simple guide that i tested on windows xp sp2 for install the MS debugging tools, the first step for who is learning how OS work, is start at "startup process".

http://en.wikipedia.org/wiki/Windows_NT_startup_process

The tools that you can use for look how the OS work on NT:

-MS Virtual PC
-Debugging tools for windows
------------------------------------------------------------------------------------

First - Installation

Install MS Virtual PC Link: Click here to download

Install Microsoft SDK Link:Click here to download

------------------------------------------------------------------------------------

Second - the Settings

Note: the target to debug here is a Microsoft Windows XP into one VM(we are using MS Virtual PC)

1.Install the Windows XP on your VM(Virtual Machine), after it edit the boot.ini file, you can do it just following some steps, open the properties of

My Computer" >> Advanced [Startup and Recovery] >> Settings >> Edit.

Now you should see something like this:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Copy it to one line below it, but add some little things like /DEBUGPORT=COM1 /BAUDRATE=115200

Should look like:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /DEBUGPORT=COM1 /BAUDRATE=115200

Now, go shutdown the VM and set up others configurations: in Virtual PC Console choose your VM, go to it settings in COM1 for example and add in Name Pipe:
\\.\pipe\kd That's a IPC that we going to use for debug from the kernel side.
Done it you can start VM if you want, if you do it, choose the second line that you added to the boot.ini(i mean the line that specify the parameters to debug)

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /DEBUGPORT=COM1 /BAUDRATE=115200

Configuring the WinDbg
After you do the previous things do the following:
1.make a .bat file with some contents that i will write below.

if you got the "Windows Symbol Packages" from the microsoft website and unpacked them to c:\windows\symbols...

windbg -y C:\WINDOWS\Symbols -k com:pipe,port=\\.\pipe\kd,resets=0,reconnect

else

windbg -y SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols -k com:pipe,port=\\.\pipe\kd,resets=0,reconnect

later, be sure that VM is running and all settings are done, you can verify the pipe made by VM using follow tool:

Link:Click here to download Run it from prompt(console mode).

Do you see the name kd?

If you see you can go on.

------------------------------------------------------------------------------------

Third - Testing

Now, go to the host window, execute the .bat file that you had created to run windbg,
if you see "Opened \\.\pipe\kd Waiting to reconnect...", go to:

Debug >> Kernel Connection >> Cycle Initial Break.

Now, restart the VM and you get it waiting for your commands. :)

------------------------------------------------------------------------------------

Complementary study

Virtualization(related to MS Virtual PC)
http://en.wikipedia.org/wiki/Virtualization
Reverse Engineering(related to WinDbg)
http://en.wikipedia.org/wiki/Reverse_engineering

------------------------------------------------------------------------------------