1

Can somebody tell me how to load a .sys file into Immunity Debugger correctly ? Because when I load a driver into Imm. Debugger then I get the message that HAL.dll could not be found and that Imm. Debugger could not find the entry point.

I tried the solutins at Loading a Driver in Immunity but that does not help.

I do not know what to do.

Best regards,

1
  • You got to use windbg ,install the driver/sys on a machine/vm and debug remotely...immunity/olly are ring 3 debuggers ,you need ring 0 debugger i.e. windbg...
    – rebel87
    Jan 2, 2017 at 4:44

1 Answer 1

1

.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (ntoskrnl.exe) or kernel-mode DLLs such as hal.dll. AFAIR someone made fake DLLs to simulate enough kernel APIs to achieve unpacking of drivers in user-mode debuggers like Olly but I don't have a link handy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.