0

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host machine.

The setup is as here

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-debugging-using-kd

I also followed the guide here.

So I setup a server using .server tcp:port=5004 (on a kernel kd session).

When I connect remotely by using cdb -remote tcp:Port=5004,Server=HOST it works. But when I try to connect using IDA, it doesn't work.

I have IDA 7.0 x64. I tried to use windbg(x64) debugger with connection string tcp:Port=5004,Server=HOST and parameter -remote and many other variations. It failed to launch in all cases.

It usually types:

Windbg: using debugging tools from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\'
Connecting in kernel mode with 'tcp:port=5004,server=HOST'
Connect failed: The parameter is incorrect.

What did I do wrong?

BTW, the version of the debugging tools of IDA and in the host machine is the same.

1 Answer 1

1

Eventually, I have used kdsrv(x86) in the host machine :

Kdsrv -t tcp:port=5006

And in IDA the following connection string:

kdsrv:server=@{tcp:port=5006,server=HOST},trans=@{com:port=com1,baud=115200}

and it worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.