0

I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running windows 10. I'm trying to debug a driver on the VM, which loads at boot.

I'm connecting windbg with a "connection string" (named pipe). As soon as it begins to load into windows on the VM, it breaks because I set "break on debug start". I then enter the command into the IDA console: sxe -c ".echo break on blah.sys;" ld:blah.sys

I then click "continue" and it continues to load into windows, and the output window shows lots of modules loading. When it loads blah.sys, it prints the text "break on blah.sys" into the output window, but it doesn't break, it doesn't even slow down, it continues loading more modules... and I arrive at the windows desktop!

I tried this with "hardware breakpoints" enabled, and also with them disabled, and it changed nothing. It just prints the text but doesn't actually break.

I also tried simplifying the command to: "sxe id blah.sys" (without quotes), leaving off the -c part. It now breezes past the loading of blah.sys without printing any debug message, but also doesn't break either. So that didn't help.

I'm pretty stuck on this, especially since this is my first time remote debugging. Anyone know why it isn't breaking?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.