a bit more on Spectre/Meltdown

Meltdown and Spectre: What about drivers?

https://github.com/iadgov/Spectre-and-Meltdown-Guidance

https://github.com/hannob/meltdownspectre-patches

https://github.com/hackingportal/meltdownattack-and-spectre

https://kb.netgear.com/000053240/Security-Advisory-for-Speculative-Code-Execution-Spectre-and-Meltdown-on-Some-ReadyNAS-and-ReadyDATA-Storage-Systems-and-Some-Connected-Home-Products-PSV-2018-0005

OSR on debugging bad Windows drivers

OSR has a nice blog post that shows how to debug bad drivers. OSR is a smart group of Windows-centric driver consultants, check out their NT Insider newsletter if you’re into NT. And their NTdev mailing list.

[…]The bugcheck makes much more sense now. Someone’s stack expansion callback was called at DISPATCH_LEVEL (Arg2 == 2) and returned at PASSIVE_LEVEL (Arg1 == 0). That’s against the rules, thus you get a system crash. Personally I would call this a bug in KeExpandKernelStackAndCalloutEx seeing as how it is generating an IRQL_UNEXPECTED_VALUE using invalid (unexpected?) arguments. At a minimum the documentation is currently wrong though and I have filed a bug to try to get that addressed.

Unexpected Case of Bugcheck IRQL_UNEXPECTED_VALUE (C8)

http://www.osronline.com/showthread.cfm?link=281770

https://www.osr.com/developers-blog/

http://www.osronline.com/showlists.cfm?list=ntdev

http://www.osronline.com/index.cfm

Hmm, it looks like OSRonline.com is becoming ‘legacy’. If there’s not a future home for some of the tools listed there, you might want to grab a set of tools while you still can. The tools are somewhat like SysInternals-style of tools.

 

OSR on Windows IoT on Rasberry PI 3

Peter at OSR has a new blog post about using Embedded Windows — now called Windows IoT — on a Rasberry PI3, with a lot of advice for embedded Windows developer using this beta platform.

[…] You can’t connect WinDbg to the RPI 3 via the network.  You have to use the serial port.  To be successful in this endeavor, you’ll need a super-secret TTL to USB Serial Port cable (this one from Adafruit works just dandy).  […]

Secrets of Using Win10 IoT Core on the RPI 3 (and staying sane)

If you do Windows, and have not looked at OSR’s online resources, it is worth a look, they have some tools that beat SysInternals, and the NTDev mailing list is probably the best public source of NT experienced developers, and one of the few places outside MSDN blogs that Microsoft developers publicly post technically useful information:
http://www.osronline.com/section.cfm?section=27
http://www.osronline.com/cf.cfm?PageURL=showlists.cfm?list=NTDEV