I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64.
There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a bunch of memory.
- Detecting the
- Finding all loaded modules in this bunch of memory
- and finally analysing the detected modules to get exported names and stuff like that
I was able to solve the first parts with this script.
The script tries to get the pdb information for each loaded module, but I want to get IDA to analyse the loaded modules themselves, as there are already all needed information in the PE header (I think). Is this possible with IDA or with IDAPython?
Edit: I was able to set a module for every detected segment with these commands:
from idaapi import module_info_t current_module = module_info_t() current_module.base = 0xFFFF... current_module.size = 1234 current_module.name = "ntoskrnl.exe" idaapi.add_virt_module(current_module)
But if i activate "Analyse module" nothing happens. Is it possible, that the PE header in memory is not complete?