Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Can somebody tell me how to load a .sys file into Immunity Debugger correctly ? Because when I load a driver into Imm. Debugger then I get the message that HAL.dll could not be found and that Imm. Debugger could not find the entry point.
I tried the solutins at Loading a Driver in Immunity but that does not help.
I do not know what to do.
Best regards,
.sys extension is usually used for drivers. While they are the same PE executables, they run in kernel mode and thus use kernel-mode APIs exposed by the kernel executive itself (ntoskrnl.exe) or kernel-mode DLLs such as hal.dll. AFAIR someone made fake DLLs to simulate enough kernel APIs to achieve unpacking of drivers in user-mode debuggers like Olly but I don't have a link handy.
