0

I'm new to remote debugging so plz bare with me.

I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is a kernel mode debug. The vmware guest is running windows 10 as well. I've tried using the command sxe -c "break plz" Id:blah.sys, but all that does is prints "break plz" into the IDA console when it loads the blah.sys module, but it does NOT break on IDA. And I don't know why. I asked that in another question here, but nobody has answered.

So I'm using IDA's other option: to break on every module. It takes about 30 minutes of pressing F9 before it finally reaches the loading of blah.sys, which is the driver I'm trying to debug. But the exact location where it's stopped is at "nt:FFFFF8056ADFF0C0 DebugService2", which I don't think is my blah.sys driver at all. And the only code on my screen is a small function with a "trap for debugger". If I try to step with F7, it pops a big message box on my screen asking if I want to "run" or "step". If I click "step", it instantly crashes vmware. If I click "run", it runs to the next module load (since I told it to stop at every module load).

I've also tried various ways to break at blah!DriverEntry, but all attempts to do that (using sxe, bp, bu, and bm) just give various errors, I think because it hasn't resolved where exactly DriverEntry is. But that's only my best guess (I'm new to this). Once the blah.sys module has loaded, I can click it, and select "Analyze" which takes a memory snapshot. But it still doesn't seem to know where "DriverEntry" is. The "function" window still doesn't list any functions by the name of "DriverEntry" even after I analyze the blah.sys file.

Other things I've tried: When the module for blah.sys loads, I can select it, click analyize, and also click "break on access". And this also does absolutely nothing. It never breaks. In fact, I can select every single module in IDA's module window, which is all the window's kernel modules, and click "break on access", and then I can do anything I want in the VM, such as log into windows, run notepad, etc, and it never breaks.

I think something is seriously wrong with IDA Pro. It doesn't break on sxe commands, or "break on access". And when it breaks during "break on module load", I can't step. Am I doing something wrong? I've been trying for four solid days. :(

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.