I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with driver entry point. I Use ida pro 7.0 + windbg plugin. I have tried to break as suggested on other question using:
sxe -c ".echo mpAxkSGg3 loaded;" ld:mpAxkSGg3.sys
But it doesn't work for some reason, debugger doesn't break. How can i do this other way? I have discovered, that
MmLoadSystemImageEx but i don't see actualt Driver Entry call there. Can someone guide me the right way to do this?
P.S. I can't modify the driver itself, it is signed with some certificate, so i suppose if i just patch the first bytes to
int 3 the whole hash will be invalid, and driver won't load