Nir Lichtman
Nir Lichtman
  • 107
  • 1 804 742
Diving into Windows Keyboard Driver
In this video I will demonstrate how you can cause funny behavior of the Windows PS/2 keyboard driver by connecting with a kernel debugger and modifying the assembly.
Checkout my channel welcome link for setup information about windbg and VirtualBox.
You can grab the Windows 10 ISO from the Microsoft official website.
Articles:
- reactos.org/wiki/I8042prt.sys
- wiki.osdev.org/%228042%22_PS/2_Controller
Переглядів: 7 244

Відео

What Happens If We Stack Overflow in Linux Kernel
Переглядів 21 тис.День тому
What Happens If We Stack Overflow in Linux Kernel
Drawing Graphics with C and Windows API is Easy
Переглядів 23 тис.14 днів тому
In this video I will demonstrate basic usage of Windows GDI to draw graphics on the screen. Code: github.com/nir9/poc/blob/master/win/draw.c
Making Minimal Linux Distro with Buildroot
Переглядів 17 тис.14 днів тому
In this video I will demonstrate how you can use Buildroot to create a simple x64 Linux distro Dependencies (Ubuntu packages): apt install g make libncurses-dev unzip bc bzip2 libelf-dev libssl-dev extlinux
Making a Very Minimal Windows Executable in C
Переглядів 70 тис.21 день тому
In this video I will demonstrate how you can instruct the Visual Studio linker to produce a very minimalist executable You can get the reverse engineering software that I use in the video by running "winget install Rizin.Cutter"
Screwing Up Linux Kernel Keyboard Driver
Переглядів 24 тис.Місяць тому
Screwing Up Linux Kernel Keyboard Driver
What Happens When Booting Linux with Low Memory
Переглядів 60 тис.Місяць тому
In this video I will demonstrate how Linux reacts when it boots with too little memory. Documentation used in video: Kernel Docs - SysReq: docs.kernel.org/admin-guide/sysrq.html Wikipedia ASLR: en.wikipedia.org/wiki/Address_space_layout_randomization
How Windows API Works Under the Hood
Переглядів 14 тис.Місяць тому
In this video we will follow a Python open file function call all the way to the native API of Windows. Tools: - windbg - winget install windbg - Visual Studio Build Tools - Python 3.10 IDLE Docs used in video: NtDoc (unofficial) - ntdoc.m417z.com/ntcreatefile Win32 Docs (official) - learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew Python 3.10 docs - docs.python.org/3....
What Happens When Linux Runs Out of Memory?
Переглядів 52 тис.Місяць тому
In this video we will explore how Linux reacts to a low memory situation. Kernel documentation article from video: www.kernel.org/doc/gorman/html/understand/understand016.html
30 Beginner Vim Commands in 7 Minutes
Переглядів 7 тис.Місяць тому
30 Beginner Vim Commands in 7 Minutes
How does a USB keyboard talk with your computer?
Переглядів 17 тис.Місяць тому
In this video I demonstrate how you can sniff USB packets and identify the packets coming from the keyboard. Installations: - usbpcap - winget install usbpcap - wireshark - winget install wireshark Docs: - OSDev Wiki HID page -wiki.osdev.org/USB_Human_Interface_Devices
Making Minimalist Web Server in C on Windows
Переглядів 7 тис.Місяць тому
In this video I will demonstrate how to make a simple web server in C on Windows using Windows Sockets (winsock). Code: gist.github.com/nir9/2db83a89c18a8add1e705710e9303208
Quick Look at FreeBSD
Переглядів 17 тис.Місяць тому
Quick Look at FreeBSD
Reverse Engineering Simple Windows Driver
Переглядів 6 тис.2 місяці тому
In this video I will demonstrate how you can reverse engineer a simple "Hello, World" driver on Windows 10. Dependencies: - Cutter: winget install Rizin.Cutter - Windows Debugger (windbg): winget install Microsoft.WinDbg Docs: - DbgPrint: learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-dbgprint - COM Port Kernel Debugging: learn.microsoft.com/en-us/windows-hardware/drivers/deb...
Making Your Own Simple Man Page
Переглядів 4,6 тис.2 місяці тому
Making Your Own Simple Man Page
The Importance of Resource Cleanup in C
Переглядів 5 тис.2 місяці тому
The Importance of Resource Cleanup in C
Windows API Window Messages Explained
Переглядів 3,1 тис.2 місяці тому
Windows API Window Messages Explained
Making Snake Boot Sector Game in Assembly (x86)
Переглядів 9 тис.2 місяці тому
Making Snake Boot Sector Game in Assembly (x86)
Making Minimalist Web Server in Assembly on Linux (x64)
Переглядів 35 тис.3 місяці тому
Making Minimalist Web Server in Assembly on Linux (x64)
Windows API Memory Mapped Files Explained
Переглядів 5 тис.3 місяці тому
Windows API Memory Mapped Files Explained
Making Simple Shared Object (.so) in C on Linux
Переглядів 7 тис.3 місяці тому
Making Simple Shared Object (.so) in C on Linux
3 Cool Bash Tricks (Jobs, Debugging Scripts, Math)
Переглядів 5 тис.3 місяці тому
3 Cool Bash Tricks (Jobs, Debugging Scripts, Math)
Windows Kernel Debugging Introduction
Переглядів 6 тис.3 місяці тому
Windows Kernel Debugging Introduction
Making Simple Graphical Linux Distro from Scratch
Переглядів 48 тис.3 місяці тому
Making Simple Graphical Linux Distro from Scratch
Making Tiling Window Manager in C on Windows
Переглядів 33 тис.3 місяці тому
Making Tiling Window Manager in C on Windows
Using Vim Like a Chad
Переглядів 8 тис.4 місяці тому
Using Vim Like a Chad
Making Minimalist Chat Server in C on Linux
Переглядів 38 тис.4 місяці тому
Making Minimalist Chat Server in C on Linux
Making Driver That Blue Screens Windows using C
Переглядів 5 тис.4 місяці тому
Making Driver That Blue Screens Windows using C
Making Simple GUI Window in C on Windows
Переглядів 19 тис.4 місяці тому
Making Simple GUI Window in C on Windows
Making Simple X11 GUI Window in C on Linux
Переглядів 21 тис.4 місяці тому
Making Simple X11 GUI Window in C on Linux

КОМЕНТАРІ

  • @kipchickensout
    @kipchickensout 2 години тому

    i didn't even know you were allowed to debug the kernel that easily nice video!

  • @valeriypopov8444
    @valeriypopov8444 5 годин тому

    writing code in vim is so difficult - big respect

  • @ZEROxDEADDEAD
    @ZEROxDEADDEAD 11 годин тому

    Last time I used windbg it offloaded the dump onto an innaccessible directory despite admin privelages. Lmao

  • @BengalEmpire767
    @BengalEmpire767 14 годин тому

    Nooo, windbg😢. Haha lol, its almost amazing how the app became a meme. Jokes aside, this is actually a very good video. You have earned a new subscriber.❤

  • @idkwhattoget
    @idkwhattoget 15 годин тому

    i have a problem while making busybox when i do the make install part, there is a lot of errors and they all complain about undefined and undeclared things here are some of those errors: networking/tc.c:255:16: error: ‘TCA_CBQ_LSSOPT’ undeclared (first use in this function) 255 | if (tb[TCA_CBQ_LSSOPT]) { | ^~~~~~~~~~~~~~ networking/tc.c:256:61: error: invalid application of ‘sizeof’ to incomplete type ‘struct tc_cbq_lssopt’ 256 | if (RTA_PAYLOAD(tb[TCA_CBQ_LSSOPT]) < sizeof(*lss)) | ^ networking/tc.c:261:16: error: ‘TCA_CBQ_WRROPT’ undeclared (first use in this function) 261 | if (tb[TCA_CBQ_WRROPT]) { | ^~~~~~~~~~~~~~ networking/tc.c:262:61: error: invalid application of ‘sizeof’ to incomplete type ‘struct tc_cbq_wrropt’ 262 | if (RTA_PAYLOAD(tb[TCA_CBQ_WRROPT]) < sizeof(*wrr)) | ^ networking/tc.c:267:16: error: ‘TCA_CBQ_FOPT’ undeclared (first use in this function) 267 | if (tb[TCA_CBQ_FOPT]) { | ^~~~~~~~~~~~ networking/tc.c:268:59: error: invalid application of ‘sizeof’ to incomplete type ‘struct tc_cbq_fopt’ 268 | if (RTA_PAYLOAD(tb[TCA_CBQ_FOPT]) < sizeof(*fopt)) | ^ networking/tc.c:273:16: error: ‘TCA_CBQ_OVL_STRATEGY’ undeclared (first use in this function) 273 | if (tb[TCA_CBQ_OVL_STRATEGY]) { | ^~~~~~~~~~~~~~~~~~~~ networking/tc.c:274:67: error: invalid application of ‘sizeof’ to incomplete type ‘struct tc_cbq_ovl’ 274 | if (RTA_PAYLOAD(tb[TCA_CBQ_OVL_STRATEGY]) < sizeof(*ovl)) | ^ networking/tc.c:277:50: error: invalid application of ‘sizeof’ to incomplete type ‘struct tc_cbq_ovl’ 277 | (unsigned) sizeof(*ovl)); | ^ networking/tc.c:293:23: error: invalid use of undefined type ‘struct tc_cbq_lssopt’ 293 | if (lss && lss->flags) { | ^~ networking/tc.c:296:24: error: invalid use of undefined type ‘struct tc_cbq_lssopt’ 296 | if (lss->flags&TCF_CBQ_LSS_BOUNDED) { | ^~ networking/tc.c:296:32: error: ‘TCF_CBQ_LSS_BOUNDED’ undeclared (first use in this function) 296 | if (lss->flags&TCF_CBQ_LSS_BOUNDED) { | ^~~~~~~~~~~~~~~~~~~ networking/tc.c:300:24: error: invalid use of undefined type ‘struct tc_cbq_lssopt’ 300 | if (lss->flags&TCF_CBQ_LSS_ISOLATED) { | ^~ networking/tc.c:300:32: error: ‘TCF_CBQ_LSS_ISOLATED’ undeclared (first use in this function) 300 | if (lss->flags&TCF_CBQ_LSS_ISOLATED) { | ^~~~~~~~~~~~~~~~~~~~ networking/tc.c:308:24: error: invalid use of undefined type ‘struct tc_cbq_wrropt’ 308 | if (wrr->priority != TC_CBQ_MAXPRIO) | ^~ networking/tc.c:308:38: error: ‘TC_CBQ_MAXPRIO’ undeclared (first use in this function) 308 | if (wrr->priority != TC_CBQ_MAXPRIO) | ^~~~~~~~~~~~~~ networking/tc.c:309:46: error: invalid use of undefined type ‘struct tc_cbq_wrropt’ 309 | printf("prio %u", wrr->priority); | ^~ networking/tc.c:313:43: error: invalid use of undefined type ‘struct tc_cbq_wrropt’ 313 | printf("/%u ", wrr->cpriority); | ^~ networking/tc.c:314:32: error: invalid use of undefined type ‘struct tc_cbq_wrropt’ 314 | if (wrr->weight != 1) { | ^~ networking/tc.c:315:65: error: invalid use of undefined type ‘struct tc_cbq_wrropt’ 315 | print_rate(buf, sizeof(buf), wrr->weight); | ^~ networking/tc.c:318:32: error: invalid use of undefined type ‘struct tc_cbq_wrropt’ 318 | if (wrr->allot) | ^~ networking/tc.c:319:57: error: invalid use of undefined type ‘struct tc_cbq_wrropt’ 319 | printf("allot %ub ", wrr->allot);

  • @kinershah464
    @kinershah464 18 годин тому

    Nice video, very informative. I am curious to know what is ramfs and cpio? What is newc?

    • @nirlichtman
      @nirlichtman 9 годин тому

      Thanks! Checkout my video about making a minimal Linux distro for more information about these questions

  • @824pavel
    @824pavel 19 годин тому

    I'm watching this video from FreeBSD 13.2 installed on my Lenovo T440s laptop. I have been using FreeBSD as a desktop OS for more than 3 years and don't want to switch back to Linux.

  • @h4rlystesh491
    @h4rlystesh491 День тому

    How difficult to add package manager for this distro? For example pacman or nix.

  • @dkkogmaw1311
    @dkkogmaw1311 День тому

    How can you link it static … im stuck at this point

  • @FlamingSwordful
    @FlamingSwordful День тому

    AVERAGE dwm user morning routine

  • @tentimesful
    @tentimesful День тому

    I did engineering work where I had to do alot of copying and pasting, well the ctrl+c failed alot and didnt know if I copied or not.. so made a program that would listen to my keyboard and show green in taskbar if I pressed ctrl+c or ctrl+v(paste) lol... and it helps.. well I student at university I was reminded him saying that they make ctrl difficult to press as in previous gaming it could be pressed with other buttons that disrupt the gaming so you really need to press it hard, my current laptop didnt needed a hard ctrl press but now it does for copy and paste what a shame... and if the manifacturers are really doing that to people do stop that garbage and make the press easier even for ctrl...

  • @neumanngregor
    @neumanngregor День тому

    if you remove =0; it woks as you dont go outside the memory space allocated for your app.

  • @kinershah464
    @kinershah464 День тому

    What is that formula badness_for_task, how does it work?

  • @milk-it
    @milk-it День тому

    If you can code this in HTML and CSS, you can code this in C.

  • @d_sanu
    @d_sanu День тому

    Great video Sir. You are always to the point 👍

  • @ChandrashekarCN
    @ChandrashekarCN День тому

    💖💖💖💖

  • @powerpc6037
    @powerpc6037 2 дні тому

    2KB is still quite big for a program that does literally nothing. The smallest exe I ever saw, was on my Amiga. It was only 56 bytes large and was called "reboot". It does simply reboot the Amiga straight away without any prompt. And it wasn't a batch file or anything. Opening it in a hex editor really showed hex codes like a real exe file.

  • @yaSSeraitnaSSer
    @yaSSeraitnaSSer 2 дні тому

    question : what happens when the parent process dies first? does it not create a zombie process? and if so how did the program work after killing the parent process? thank you for the content sir keep it up!

  • @RatCorp_
    @RatCorp_ 2 дні тому

    Wtf speed typing bro

  • @user-ft6zh8ny9i
    @user-ft6zh8ny9i 2 дні тому

    I've wrote a bunch of functions in masm64 assembly and can use it. buy i can't create a .lib file and connect it to executable. My functions are inside namespace in C++. and it says that can't find a reference to function. Can you, please, help me with that? thank you:)))

  • @bihanbanerjee
    @bihanbanerjee 2 дні тому

    Thanks bro. ❤

  • @nonsuch
    @nonsuch 2 дні тому

    Smart.... Brains.... (Bugs Bunny reference 😄). Awesome work! Cheers🥂

  • @qbasicmichael
    @qbasicmichael 3 дні тому

    I'm a little rusty on msvc++, but in mingw, things you can do, other than omitting the crt init code, include enabling optimization, and stripping symbols.

  • @qbasicmichael
    @qbasicmichael 3 дні тому

    Dereferencing a null pointer causes a page fault in the processor, which the operating system turns into an access violation exception.

  • @HAGSLAB
    @HAGSLAB 3 дні тому

    Very nice demonstration of debugging a remote Windows machine :)

  • @bmx666bmx666
    @bmx666bmx666 3 дні тому

    Bless you man! You explained how to connect and debug Windows in 10 minutes! Always fantastic! 🥳😀

  • @kinershah464
    @kinershah464 3 дні тому

    Nice video, WinDbg is so similar to gdb or maybe better 🤔. So to summarize working, user level function calls the windows api functions which in turn calls kernel functions which actually execute the operation (syscall). Right?

  • @kinershah464
    @kinershah464 3 дні тому

    So much cool information. Very important error handling, right error handling with right tools and you can avoid hours of debugging an issue.

  • @stephenkolostyak4087
    @stephenkolostyak4087 3 дні тому

    "Now you can see the rectangle is growing." But does it blend?

  • @leonardotry
    @leonardotry 3 дні тому

    Now what if you remove the stack guard handler and allow it to "really" overflow? how would that system crash look? :D

  • @kinershah464
    @kinershah464 3 дні тому

    Thanks for this video. I wonder how Windows uses this internally and when does it create and throw a blue screen. Man, Windows is amazing.

  • @ronalerquinigoagurto555
    @ronalerquinigoagurto555 3 дні тому

    I would recommend making a video about hypervisor internals

  • @kinershah464
    @kinershah464 3 дні тому

    Nice video. I didn't understand the compiler option /LD, what does it do? Also I noticed that nirsDll.lib was generated, when is lib file also needed along with dll?

  • @PavitraGolchha
    @PavitraGolchha 3 дні тому

    How to remap Copilot key to R Ctrl key on newer windows laptops? Custom drivers or registry hacks? PowerToys works but doesn't work on all apps.

    • @mertemr
      @mertemr 3 дні тому

      you can use autohotkey.

  • @hoteny
    @hoteny 3 дні тому

    1:02 whats the other driver then?

    • @Hallilo
      @Hallilo 3 дні тому

      the ps2 keyboard driver is responsible for reading the hardware level data from the I/O port, kbdclass is a higher level driver that communicates with the ps2 driver and gives some consistency to the os with abstraction (correct me if im wrong)

  • @electrolyteorb
    @electrolyteorb 3 дні тому

    Just casually adding syscalls to kernel... Yeah seems about right

  • @TheTim2626
    @TheTim2626 3 дні тому

    thanks bro, really nice demonstration of windows driver debbuging, love it !!!!

  • @kinershah464
    @kinershah464 3 дні тому

    Simple and straightforward 👌

  • @spirosgaliatsatos4384
    @spirosgaliatsatos4384 3 дні тому

    Reminds me when I used to do assembly in DOS. I used this port to detect a keypress instead of using the BIOS int 16h keyboard services

  • @gokul2003g
    @gokul2003g 3 дні тому

    Screw up some linux stuff next, please.

    • @_lun4r_
      @_lun4r_ 3 дні тому

      The screwed up keyboard for Linux already exists, check the videos

    • @gokul2003g
      @gokul2003g 3 дні тому

      @@_lun4r_ ooh 👍

  • @ahmadshami5847
    @ahmadshami5847 3 дні тому

    That's awesome! I'm wondering though why when the cmp instruction was set the address jumped from ...64 to ...68? It doesn't seem like the instruction is using any large values to fill up what I presume is 32 bytes (ig each address can store 8 bytes but please correct me if I'm wrong).

    • @b4ttlemast0r
      @b4ttlemast0r 3 дні тому

      I think each address just refers to a single byte (the address itself is what's 64-bits)

    • @ahmadshami5847
      @ahmadshami5847 3 дні тому

      @@b4ttlemast0r yeah idk maybe that could something related to the OS kernel or maybe even the hardware itself. But still even then it doesn't make sense for me that a compare instruction would require 4 bytes if that's the case.

    • @nirlichtman
      @nirlichtman 3 дні тому

      The cmp instruction took in total 4 bytes even though we are in 64 bit, since the jump in this case is relative and not absolute so the machine code doesn't need to store the entire 8 bytes of the memory address

    • @ahmadshami5847
      @ahmadshami5847 3 дні тому

      hmmm... okay, I must say I'm still kinda new to low level machine stuff, but that's fascinating. So what I understood is that the cmp instruction could make use of those 4 addresses but it didn't so it just skipped them, right?

    • @nirlichtman
      @nirlichtman 3 дні тому

      @@ahmadshami5847 could you elaborate what exactly you mean?

  • @MrOnlineCoder
    @MrOnlineCoder 3 дні тому

    If I remember correctly, osdev may also mention about a specific byte sequence you send or read from ps/2 keyboard in order to initiate system reboot, which is often used in hobby kernels and I guess I've even seen it in linux somewhere

    • @0xfadead
      @0xfadead 3 дні тому

      Do you mean Ctrl-Alt-Delete? That was used to reboot computers in the DOS days

    • @komram4396
      @komram4396 3 дні тому

      @@0xfadead nah, there is a keycode for reboot, i have an 90s keyboard with such key and it works in modern operating systems.

    • @nathanielcleland6566
      @nathanielcleland6566 3 дні тому

      @@0xfadead No, in the old days the RESET line of the x86 CPU was connected to the 8042 keyboard controller. Ctrl+Alt+Delete is just a sequence of key presses given special meaning in the OS. But if you poll port 0x64 until the controller is ready, then write 0xFE, it resets the CPU to its initial state, rebooting the system. Although this is actually how you switched out of 16 bit protected mode back into real mode on the 80286 as well (as memory stays powered, you can hook into the reset handler and skip system initialization). void reboot() { uint8_t good = 0x02; while (good & 0x02) good = inb(0x64); outb(0x64, 0xFE); halt(); }

    • @0xfadead
      @0xfadead 3 дні тому

      @@nathanielcleland6566 Ah lol, didn't know about that. It makes much more sense. Thanks for the swift response!

  • @adamz1671
    @adamz1671 3 дні тому

    this is cool

  • @RahulNarsing-lx9pi
    @RahulNarsing-lx9pi 3 дні тому

    yay, i am first

  • @stephenhaslam6642
    @stephenhaslam6642 4 дні тому

    Thankyou very much, awesome. That worked really well for me. I am following arm assembly video tutorials, but so far their examples do not work on my Raspberry Pi 4b, your tutorial works awesome. Can you do a assembly series, would love to follow along. Assembly is excellent.

  • @421sap
    @421sap 4 дні тому

    In Jesus' Name Amen ✝️. God bless you abundantly!

  • @faucar93
    @faucar93 4 дні тому

    I was looking for this since I was 10 !!!!!! Thank you so much

  • @vlc-cosplayer
    @vlc-cosplayer 4 дні тому

    The rudest StackOverflow user would still be no match for Linus at his most polit-- wait, it's not that kind of stack overflow?

  • @vladde
    @vladde 4 дні тому

    your windows setup is nice! what window manager do you use? :)

    • @nirlichtman
      @nirlichtman 4 дні тому

      Thanks! Using one I am building called LightWM :)

  • @calderov
    @calderov 4 дні тому

    Man, your channel is gold!❤