I am currently learning Malware Analysis using the book "Practical Malware Analysis", and I am going along with the chapter on Kernel debugging. When viewing the same code snippet on WinDbg and on IDA, I can see that windbg only resolves the function calls on the call to this instruction, i.e. disassembly from windbg

Viewing the same code snippet in IDA, I can see the function calls are resolved statically, i.e. disassembly from windbg

Is it possible to make the disassembly from WinDbg include some of those details that IDA includes, and if so, how?

  • those are ida pros analysis output not debugging symbols windbg does not analyze and label any address while ida pro is designed to be proficient on this in windbg you can add synthetic label take a look here for starters (github.com/blabberer/windbg_labeller)
    – blabb
    Aug 7 at 4:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.