8

When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in).

Since I prefer my kernel debugging with plain WinDbg (and not the IDA-integrated WinDbg), I'd like WinDbg to recognize the names IDA (and me) gave to those addresses. That way, a) I could break on those functions by name, change variables by name, and b) WinDbg's output and views would read better (in stack traces etc.).

Unfortunately, IDA has no "create PDB" feature, and I don't even see a non-PDB way of importing addresses into WinDbg.

Ideas, anyone?

5

This page contains an IDC script And a Windbg Extension to dump the names and a WinDbg extension to load those names into WinDbg.

  • the idc script seems to work very very slow when the binary is above a few kilobytes can some one review it and comment on improving its speed or suggest alternative method to speed it up that results in same output format – blabb Apr 12 '14 at 7:20
  • In my case (kernel driver debugging), I have to set tosubtract = FirstSeg() – Ilya May 13 '14 at 17:28
  • a plugin that fetches the names in pretty fast (targeted to work in ida free 5 has been added to the thread using get_nlist_size(),name, functions it is several magnitudes faster than the script take a look – blabb May 13 '14 at 18:52
  • I can't find it. btw, I've improved the code to include function sizes. Call stacks are very interesting to me, and they weren't displaying correctly when the size was always 4 -- here's the change, pretty trivial: gist.github.com/ikonst/ebae548dac7934dc0bdf – Ilya May 13 '14 at 21:41
  • woodmann.com/forum/… the fifth post in thread contains the idc replacement ida plugin =========================================== my personal opininon you should at the least credit the original authour in your github =========================================== – blabb May 13 '14 at 22:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.