My issue is all about setting the breakpoint on x64 Windbg.
For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine.
For instance, in x86 I have
sub_401000, so, the corresponding breakpoint is set by
In x64 I have address
sub_140001000, so, I'm trying to set as follows
bp 140001000 and get no result at all. Application won't reach my breakpoint. That's why, I've just set
bp 1401172F1 that reaches the address of interest for sure.
But now I've faced with error
Unable to insert breakpoint 0 at 00000001`401172f1, Win32 error 0n998 The breakpoint was set with BP. If you want breakpoints to track module load/unload state you must use BU. bp0 at 00000001`401172f1 failed WaitForEvent failed
All these answers make sense, but setting breakpoint for this rva leads to error for some reason. Maybe I should try something else?
0:000> lmi start end module name 00000000`77570000 00000000`77719000 ntdll (pdb symbols) C:\Windows\SYSTEM32\ntdll.dll 00000000`77740000 00000000`77743000 normaliz (deferred) 00000001`3fd90000 00000001`402e0000 module_of_interest (no symbols)