2

I asked this question at the StackOverflow website and they referenced me here.

(Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-debugging?noredirect=1#comment44253284_27917592 )

I want to debug a specific process on a remote system and the only way i can do that is to use the kernel debugging method. It works pretty good with just WINDBG, but i think ida can give me the extra edge i need for a better reversing experience.

So far debugging with windbg was successfull but now when i am using the windbg plugin in ida: Ida issue

what i am actually experiencing is that i cant get the extra analysis from ida, all i can do is attach only to the process it self (only one available to attach to). and in the Modules window all i can see is the ntkrpamp.exe, which i assume is the kernel process.

i can use all WINDBG regular commands like !process 0 0, etc.. and can debug normally but nothing shows in the IDA window

I have never debugged dynamically using IDA but i can see it is possible..

could it work aswell in a kernel debugging session?


I also noticed it is possible to analyze a model if i set a breakpoint with the windbg plugin and when IDA hits that breakpoint, this module is added to the IDA Modules windows.

It would be a lot easier if i could just analyze it without pre-putting a breakpoint on the specific module and waiting for it to hit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.