Have Geek Brain

Windbg + IDA: calculates the address in the module

I am debugging remotely a Windows XP machine. One of my drivers is loading from 0xb2c4c000 to 0xb2cb9680.

Now when I open my driver in IDA the offset where I want to set the breakpoint is at 00017619.

How can I effectively map my IDA address to windbg?

I've tried the obvious one, which is to sum 0xb2c4c000 + 00017619 = 0xB2C635F7 and parse that address using the u command in windbg. But the results don't match the build in IDA.

On the side of the question: is there a way to reverse a command that works in windbg? Several times I've run commands that took time to process, I would like to be able to undo them if necessary. Therefore, I can continue to work.

Thank you for your time.

+2


a source to share


2 answers


Recent versions of IDA Pro allow you to debug device drivers through its WinDbg debugger plugin.



Another alternative is that you can rebuild your database according to the base of the loaded module and, like you, there is a one-to-one mapping between the idb and windbg session.

+1


a source


You are adding incorrectly. Since IDA assumes 10000 as an entry point, the correct way to add is



0xb2c4c000 + 00007619 (10000 is subtracted)

+1


a source






More articles:


All Articles