What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?

Question

Sorry if this is a stupid question but couldnt find the answer by googling

Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a folder to my IDA's VM, as of right now the way i analyze a sample is by putting it on that shared folder so i can run the remote debugger, because if i set the path to a location in my IDA's VM then it won't work (it says wrong parameters), so it looks like the sample has to be in a location where both my IDA's VM and the isolated VM can reach (i think)

so to solve this i just put samples i want to analyze in the shared folder

the problem is that the .idb file spawns there as well and if its a ransomware then my .idb file will get ruined ( i have to say that IDA's VM is also in a isolated host only network)

so two questions :

1. am i approaching this right? is there an easier way for me to use a remote debugger without using a shared folder?

2. how to change the .idb's default path? so i can put the sample in the shared folder or somewhere else but the .idb gets generated somewhere else?

Answer 1

There is no need to have the IDB on the remote machine or keep the .idb and executable in the same folder. After creating the IDB you can even delete the input file or move it elsewhere; IDB is completely self-contained and does not need the file anymore.

Here's a suggested workflow:

1. Open the sample in IDA on the analysis VM/host to create the IDB.

2. Copy the sample and remote debug server to the debugging VM. You can now delete it from the analysis machine so you don't accidentally run it (or rename). Let's assume the sample is in C:\temp\sample.exe on the debugging VM.

3. start the debug server

4. In IDA, in Debugging-Process options, specify the remote host/port and change the path to the executable as it is on the remote machine (i.e. C:\tmp\sample.exe).

5. debug away!