0

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I collected the necessary metrics, I made a full dump of the system before BSOD.

Before starting to analyze the dump in IDA, I need to remove "TARGET_MODULE” from the dump and load the original image of the module “USBPORT.sys" in his place.

After opening the dump in IDA, I tried to delete the “TARGET_MODULE" segment and load the image of the source module in its place, but this did not give any result. Binary data of the instrumented module in the IDA database doesn't change to data from the original module image. I tried doing this in the running debugging mode for dump. I also tried to stop debugging, modify the segments, and start debugging the dump again.

I tried to do it like this:

Mark the segment as "loader".

enter image description here

Deleting a segment of the instrumented module.

enter image description here

Upload the original module to the place of the deleted one.

enter image description here

Questions:

  1. Is it even possible to replace the module or segments in opened dump via IDA?
  2. What are the ways to replace the module in the Windows dump file itself?
  3. What any another ways to do it?
  4. What another tools allow to do this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.