I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status". Is there a plugin or anything else that could make me able to save my work (variables rename, commentaries and others) ? Thanks for reading (and answers =)


Did you try debug IDA? You may save your work via IDA snapshot feature.

  • I don't understand you (oh, my bad English). Did you try simple dump IDA db to IDC file?? (File->Produce file->"Dump data base to IDC file") – DOD May 19 '14 at 13:48
  • sorry wrong send, here is the full comment : Hi, thanks for your answer ! I tried with the snapshot functionality but an initial database is requiered. In order : - I start my virual machine - I attach IDA with winDBG to start kernel mode debbugging - I place comments and wanna save them for next session My problem is that I only have a temporary database and I can't save it because it's only a live work session. Any idea how to solve that ? – user4559 May 19 '14 at 13:48
  • (I'm probably hard to read, I'm french and my english is not awesome !) I never used IDC file, and I don't understand how it works for loading them. In my last message I mean that I try to save a live analysis state. So I probably need to save all the memory state of my current virtual machine if I wanna keep my comments and modifications. Is this message more clear ? – user4559 May 19 '14 at 15:00
  • I'm never had some problem. I do understand you. Sorry but I'm thinking what I can't help you. Did you try read [this]?(hexblog.com/?p=92). What version of IDA are you using? – DOD May 19 '14 at 16:39

I solved my problem with IDC files and VM snapshot =) I'm on IDA 6.4 and the snapshot function doesn't work in live debugging. My solution is to take a snapshot of my virtual machine (on VMware workstation) to have everytime the same kernel state. When I wanna reload my work, I begin to load the virtual machine snapshot then I attach IDA to my virtual machine with windbg and finally I can load my IDC file using the script file option.

Thank you very much for you answer, it really was helpful !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.