How to load a dumped process and several accompanied memory pages in IDA?

Question

I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?

Answer 1

If you are using IDA to dump the process, then you can save the contents of the memory directly to the database using the 'Take memory snapshot' feature located in the Debugger menu.

Answer 2

While waiting for an answer I've also done some searching and here what I've got in case, somebody also interested in this issue. Kris Kasperski a.k.a. nzumi gave quiet a an answer to the above question in his blog. It outdated but I hope it works. I'd appreciate if guys from IDA, can comment about Kris's solutions and it being applicable say from v5 of IDA and on.

Kris's solution:

how to load two or more files into the same IDA-Pro database

extract:

IDA Pro has linear address space emulates x86 CPU flat memory model (well, not only x86, it works with other CPUs too). the loader loads a file into virtual memory and does everything has to be done.

there is two solutions to load more files

first: we load the next file as an additional binary file (menu File, Load file, Additional binary file…). IDA Pro does nothing, just load the file, leaves us to parse all internal PE/ELF structures (I saw some IDC-scripts, written by Symantec team, but don’t remember the link). this is tedious job, so, thanks, but no thanks!

second: we use IDA Pro function: bool ida_export load_nonbinary_file (const char *original_file_name, const char *real_file_name, const char *sysdlldir, ushort _neflags, load_info_t *loader), where “loader” – result returned by load_info_t *ida_export build_loaders_list( const char *filename), – see \IDA\SDK\include\ loader.hpp. of course, we have to free the pointer with qfree function (see file pro.h).

this is all. well… since we have linear address space, we must avoid file overlapping, that means all files are supposed to have different base addresses. if they are match – we must to re-base one of them before loading (if files have relocations it’s very simple, otherwise, extremely tricky, however, it’s possible).

so, we come to plug-in, looking like this one:

void idaapi run(int arg)
{
load_info_t *ld;
warning(“plugin \”dual-load\” is called!”);

/* NOTE: KERNEL32.DLL and NTDLL.DLL has to be in the current directory!!! */
ld = build_loaders_list(“KERNEL32.DLL”);
load_nonbinary_file(“KERNEL32.DLL”, “KERNEL32.DLL”, “.”, NEF_SEGS | NEF_RSCS | NEF_NAME | NEF_IMPS | NEF_CODE, ld);
/* qfree(ld);

ld = build_loaders_list(“NTDLL.DLL”); */
load_nonbinary_file(“NTDLL.DLL”, “NTDLL.DLL”, “.”, NEF_SEGS | NEF_RSCS | NEF_NAME | NEF_IMPS | NEF_CODE, ld);
qfree(ld);
}

ok, we load notepad.exe into IDA Pro, call our plug-in and… have a fun!!! notepad.exe, kernel32.dll and ntdll.dll are loaded into the same idb-database! the only problem is: IDA Pro doesn’t create cross-references between them. I mean, if you analyze notepad.exe, move the cursor to call ds:GetModuleHandleA, press “enter” and… nothing happens! you’re into the import table of notepad.exe. and where is the export? somewhere… but, this is not a problem, really, since, we can find GetModuleHandleA in the “Names Windows” (called by Shift-F4) or write a simple IDC-script to create cross-reference between import and export, it’s like to build a bridge :-]

I did not try it yet.