How to view the GDTR's value ?
- by Mehdi Asgari
Hi
In the book "Rootkit Arsenal" page 84 (Chapter 3) mentions:
..., we can view the contents of the
target machine's descriptor registers
using the command with the 0x100 mask:
kd rM 0x100
and a paragraph below:
Note that the same task can be
accomplished by specifying the GDTR
components explicitly: kd r gdtr ....
I run Windbg on my Win XP (inside VMWare) and choose the Kernel Debug - Local.
My problem is in case of first command, windbg errors with:
lkd rM 0x100
^ Operation not supported in current debug session 'rM 0x100'
and in the second command:
lkd r gdtr
^ Bad register error in 'r gdtr'
Can anyone guide me ?