Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I find that abc.sys starts at 0xFFFF... and so to go to sub_1400AAAAA I first add the start address and 0xAAAAA and then do "db [the result of the addition]". However, when I compare the bytes shown in WinDbg with those of IDA, they are different. What am I doing wrong?

EDIT: Even when subtracting -0x1000 on top of the addition, it does not land in the right place.

type lm m abc.sys in windbg and find out what is the loaded address
lets say windbg shows
abc.sys 0x97370000

now go to ida and rebase the loaded image in ida

iirc segments rebase use the address you found in windbg

after rebasing you dont have to add subtract or grope around both will have same address

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.