My issue is all about setting the breakpoint on x64 Windbg.
For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine.
For instance, in x86 I have sub_401000
, so, the corresponding breakpoint is set by bp 401000
In x64 I have address sub_140001000
, so, I'm trying to set as follows bp 140001000
and get no result at all. Application won't reach my breakpoint. That's why, I've just set bp 1401172F1
that reaches the address of interest for sure.
But now I've faced with error
Unable to insert breakpoint 0 at 00000001`401172f1, Win32 error 0n998
The breakpoint was set with BP. If you want breakpoints
to track module load/unload state you must use BU.
bp0 at 00000001`401172f1 failed
WaitForEvent failed
All these answers make sense, but setting breakpoint for this rva leads to error for some reason. Maybe I should try something else?
0:000> lmi
start end module name
00000000`77570000 00000000`77719000 ntdll (pdb symbols) C:\Windows\SYSTEM32\ntdll.dll
00000000`77740000 00000000`77743000 normaliz (deferred)
00000001`3fd90000 00000001`402e0000 module_of_interest (no symbols)