New answers tagged

0

What I tend to do is the following. Subtract the base address of the file you loaded in IDA from the address of the function you want to find, e.g: 0x140011011 - 0x140000000 = 0x11011. Now you have the offset. In Windbg obtain the base address of the Capcom driver by doing the following: execute this command in windbg and wait a while: !drvobj Capcom. ...


0

Your DriverEntry isGiven In Your dt output +0x058 DriverInit : 0xfffff80b`f90b063c long +0 The Load is Address is Available in the same output +0x018 DriverStart : 0xfffff80b`f90b0000 Void given these 2 the RVA to Driver Entry is 0x63c find out what the Address Of Driver Entry is in IDA (most probably it will be 0x1063c ) subtract 10590 ...


0

A friend show me how to do it with IDA Python: from idaapi import * here() -get_imagebase() And in WinDBG: kd> db cfs+0x590 fffff80b`f90b0590 48 53 56 57 48 83 ec 20-48 8b 82 b8 00 00 00 48 HSVWH.. H......H fffff80b`f90b05a0 8b 7a 18 33 c9 89 4a 30-48 89 4a 38 80 38 0e 44 .z.3..J0H.J8.8.D fffff80b`f90b05b0 8b 48 10 44 8b 40 08 48-8b da 8b 50 18 74 ...


1

these should be comments but it grew up what is the windbg version ? what is the os version ? what is the output of lm m "your specific Module" are the symbols loaded for your Module ? have you tried disassembling with u <address> in command window as it appears you are looking at Disassembly Window did you try ln <address> to list the ...


Top 50 recent answers are included