I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status". Is there a plugin or anything else that could make me able to save my work (variables rename, commentaries and others) ? Thanks for reading (and answers =)
2 Answers
Did you try debug IDA? You may save your work via IDA snapshot feature.
-
I don't understand you (oh, my bad English). Did you try simple dump IDA db to IDC file?? (File->Produce file->"Dump data base to IDC file")– DODMay 19, 2014 at 13:48
-
sorry wrong send, here is the full comment : Hi, thanks for your answer ! I tried with the snapshot functionality but an initial database is requiered. In order : - I start my virual machine - I attach IDA with winDBG to start kernel mode debbugging - I place comments and wanna save them for next session My problem is that I only have a temporary database and I can't save it because it's only a live work session. Any idea how to solve that ?– user4559May 19, 2014 at 13:48
-
(I'm probably hard to read, I'm french and my english is not awesome !) I never used IDC file, and I don't understand how it works for loading them. In my last message I mean that I try to save a live analysis state. So I probably need to save all the memory state of my current virtual machine if I wanna keep my comments and modifications. Is this message more clear ?– user4559May 19, 2014 at 15:00
-
I'm never had some problem. I do understand you. Sorry but I'm thinking what I can't help you. Did you try read [this]?(hexblog.com/?p=92). What version of IDA are you using?– DODMay 19, 2014 at 16:39
I solved my problem with IDC files and VM snapshot =) I'm on IDA 6.4 and the snapshot function doesn't work in live debugging. My solution is to take a snapshot of my virtual machine (on VMware workstation) to have everytime the same kernel state. When I wanna reload my work, I begin to load the virtual machine snapshot then I attach IDA to my virtual machine with windbg and finally I can load my IDC file using the script file option.
Thank you very much for you answer, it really was helpful !