Getting IDAPro to analyse part of memory as PE-File

Question

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64.

There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a bunch of memory.

• Detecting the ntoskrnl.exe base address
• Finding all loaded modules in this bunch of memory
• and finally analysing the detected modules to get exported names and stuff like that

I was able to solve the first parts with this script.

The script tries to get the pdb information for each loaded module, but I want to get IDA to analyse the loaded modules themselves, as there are already all needed information in the PE header (I think). Is this possible with IDA or with IDAPython?

Edit: I was able to set a module for every detected segment with these commands:

from idaapi import module_info_t
current_module = module_info_t()
current_module.base = 0xFFFF...
current_module.size = 1234
current_module.name = "ntoskrnl.exe"
idaapi.add_virt_module(current_module)

But if i activate "Analyse module" nothing happens. Is it possible, that the PE header in memory is not complete?

Answer 1

Extract the image from memory using its section headers, dump to a file, have IDA call another version of itself in batch mode to rebase dump, IDC export, and exit, then run that IDC file and the data should overlay just fine