I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files.

Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded location in kernel so i can get their function names? there are multiple IDB files that can get loaded anywhere in memory.

  • I would say that the straight forward approach is to have a single idb for different modules (which is allowed but a bit buggy, it does make duplicate modules sometimes instead of relocating all modules). Look for a plugin that does it.
    – eyal karni
    Commented Feb 9, 2021 at 1:43
  • @eyalkarni how can i convert all of them into one IDB?!
    – Notoriouss
    Commented Feb 9, 2021 at 5:44
  • If no plugin, then probably would try extracting into idc script
    – eyal karni
    Commented Feb 10, 2021 at 17:19


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.