Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the debugger when to open that file with IDA Pro.

This is becoming a problem, because for example right now I have a manually mapped driver with no header dumped and analyzed, and as you can guess, I cannot debug it with IDA pro's windbg.. I have to open another instance of IDA pro, and attach it to the kernel using IDA pro's windbg, and obviously this causes me to not be able to debug it using the analyzed IDB file.

How can I overcome this? How can I tell IDA pro to please just understand that you should treat this file as a normal PE file and let me just select the damn windbg as the debugger? This is funny because I can just open an instance of IDA pro and attach it to the kernel using IDA's windbg, but when I open my IDB file, then windbg is no longer there to select...

Tried it with the latest 7.7 version and this problem is still there. Right now I just have to make a fake PE header (driver) every time I have to do this, but there has to be a better way.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.