0

I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files.

Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded location in kernel so i can get their function names? there are multiple IDB files that can get loaded anywhere in memory.

Improve this question
3
  • I would say that the straight forward approach is to have a single idb for different modules (which is allowed but a bit buggy, it does make duplicate modules sometimes instead of relocating all modules). Look for a plugin that does it.
    – eyal karni
    Feb 9 '21 at 1:43
  • @eyalkarni how can i convert all of them into one IDB?!
    – Notoriouss
    Feb 9 '21 at 5:44
  • If no plugin, then probably would try extracting into idc script
    – eyal karni
    Feb 10 '21 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.