Exetools  

Go Back   Exetools > General > General Discussion
Reload this Page Use IDA in kernel mode ??
Register Forum Rules FAQ Calendar Mark Forums Read

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-20-2012, 20:47
Veyskarami
 
Posts: n/a
Use IDA in kernel mode ??
hello
how i can use ida on kernel mode?
Reply With Quote
  #2  
Old 09-20-2012, 21:06
mm10121991 mm10121991 is offline
VIP
  
Join Date: Feb 2011
Posts: 136
Rept. Given: 29
Rept. Rcvd 56 Times in 34 Posts
Thanks Given: 7
Thanks Rcvd at 23 Times in 13 Posts
mm10121991 Reputation: 58
I remember with windbg debug and config it to kernel mode but i forgot how to do that exactly
Reply With Quote
  #3  
Old 09-20-2012, 23:12
Git's Avatar
Git Git is offline
Old Git
  
Join Date: Mar 2002
Location: Torino
Posts: 1,116
Rept. Given: 220
Rept. Rcvd 265 Times in 157 Posts
Thanks Given: 109
Thanks Rcvd at 217 Times in 125 Posts
Git Reputation: 200-299 Git Reputation: 200-299 Git Reputation: 200-299
IDA won't do kernel debugging, although Bochs that comes with it may (I don't know). Best is probably windbg. Make sure you keep a map/pdb of your driver and have a read here :
http://msdn.microsoft.com/en-us/library/windows/hardware/ff553382%28v=vs.85%29.aspx

Git
Reply With Quote
The Following User Gave Reputation+1 to Git For This Useful Post:
chessgod101 (09-21-2012)
The Following User Says Thank You to Git For This Useful Post:
nimaarek (09-20-2017)
  #4  
Old 09-21-2012, 04:16
Syoma Syoma is offline
reverse engineer
  
Join Date: May 2009
Posts: 338
Rept. Given: 35
Rept. Rcvd 77 Times in 50 Posts
Thanks Given: 15
Thanks Rcvd at 78 Times in 51 Posts
Syoma Reputation: 77
afaik, ida can debug kernel mode. Check the hexrays blog, seems I saw article about kernel debugging there.
Reply With Quote
  #5  
Old 09-21-2012, 05:33
Git's Avatar
Git Git is offline
Old Git
  
Join Date: Mar 2002
Location: Torino
Posts: 1,116
Rept. Given: 220
Rept. Rcvd 265 Times in 157 Posts
Thanks Given: 109
Thanks Rcvd at 217 Times in 125 Posts
Git Reputation: 200-299 Git Reputation: 200-299 Git Reputation: 200-299
You're right, it's an IDA plugin to link IDA with Windbg. Nice one.

http://www.hexblog.com/?p=92

Git
Reply With Quote
  #6  
Old 09-21-2012, 16:10
mcp mcp is offline
Friend
  
Join Date: Dec 2011
Posts: 73
Rept. Given: 4
Rept. Rcvd 12 Times in 11 Posts
Thanks Given: 7
Thanks Rcvd at 47 Times in 35 Posts
mcp Reputation: 12
The best solution is probably virtualkd + VMWare + IDA WinDBG as shown here. VirtualKD provides a faster communication channel for the WinDBG backend, so you are not limited to the speed of the serial COM port emulation.
Reply With Quote
  #7  
Old 09-24-2012, 17:34
virus virus is offline
Friend
  
Join Date: Apr 2002
Posts: 55
Rept. Given: 3
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 17
Thanks Rcvd at 17 Times in 11 Posts
virus Reputation: 2
VirtualKD works nice. Is there a similar solution for VirtualBox?
Reply With Quote
  #8  
Old 09-24-2012, 19:20
Syoma Syoma is offline
reverse engineer
  
Join Date: May 2009
Posts: 338
Rept. Given: 35
Rept. Rcvd 77 Times in 50 Posts
Thanks Given: 15
Thanks Rcvd at 78 Times in 51 Posts
Syoma Reputation: 77
VKD works in VBox as well.
Reply With Quote
  #9  
Old 11-29-2012, 19:05
r00t
 
Posts: n/a
I would personally listen to the other guys and use Windbg with VKD or without (depending on your configuration), however, in case you choose to pursue this you can find a tutorial here: http://www.hexblog.com/?p=123
Reply With Quote
  #10  
Old 02-20-2013, 16:23
stantheguy stantheguy is offline
Friend
  
Join Date: Mar 2012
Posts: 15
Rept. Given: 47
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 4 Times in 4 Posts
stantheguy Reputation: 3
Request for IDA
Hi guys,

Sorry if I'm a little bit off the topic but can anyone help me out with a copy of IDA. I've searched the forum but each time, I reach a dead-end as far as the search is concerned.

cheers
Reply With Quote
  #11  
Old 02-20-2013, 16:41
Syoma Syoma is offline
reverse engineer
  
Join Date: May 2009
Posts: 338
Rept. Given: 35
Rept. Rcvd 77 Times in 50 Posts
Thanks Given: 15
Thanks Rcvd at 78 Times in 51 Posts
Syoma Reputation: 77
You can find it on the official web-site or in Google.
Reply With Quote
  #12  
Old 02-21-2013, 18:18
stantheguy stantheguy is offline
Friend
  
Join Date: Mar 2012
Posts: 15
Rept. Given: 47
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 4 Times in 4 Posts
stantheguy Reputation: 3
Quote:
Originally Posted by Syoma View Post
You can find it on the official web-site or in Google.
Can you please provide me the link?
Reply With Quote
  #13  
Old 02-21-2013, 20:02
Git's Avatar
Git Git is offline
Old Git
  
Join Date: Mar 2002
Location: Torino
Posts: 1,116
Rept. Given: 220
Rept. Rcvd 265 Times in 157 Posts
Thanks Given: 109
Thanks Rcvd at 217 Times in 125 Posts
Git Reputation: 200-299 Git Reputation: 200-299 Git Reputation: 200-299
www.google.com
Reply With Quote
  #14  
Old 02-21-2013, 20:10
Syoma Syoma is offline
reverse engineer
  
Join Date: May 2009
Posts: 338
Rept. Given: 35
Rept. Rcvd 77 Times in 50 Posts
Thanks Given: 15
Thanks Rcvd at 78 Times in 51 Posts
Syoma Reputation: 77
http://google.com/search?q=IDA+Pro+6.1+download
Reply With Quote
  #15  
Old 02-23-2013, 12:38
jlucat
 
Posts: n/a
with VMware , and start remote.exe.
Reply With Quote
Reply

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Hades:Windows kernel driver lets reverse engineers monitor user and kernel mode code sh3dow Source Code 0 05-12-2016 03:15
How to pass the large data in kernel mode to user mode? benina General Discussion 3 03-06-2010 04:50
Kernel-Mode GUI!? (like SoftIce) Cobi General Discussion 1 01-21-2005 02:24
Kernel Mode Driver for NT SPeY General Discussion 12 04-22-2004 15:34


All times are GMT +8. The time now is 19:14.

Aaron's homepage - Top

Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2025 )