Skip to content

Latest commit

 

History

History
71 lines (43 loc) · 2.46 KB

README.md

File metadata and controls

71 lines (43 loc) · 2.46 KB

ida_vmware_windows_gdb.py

Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)

python3 + idapython 7.4

kerneldebugida

Usage

WARNING: BEFORE OPEN IDA your must set env var: _NT_SYMBOL_PATH to windows symbols, ex:

SRV*C:\winsymbols*
  1. Open IDA PRO, start a debug session (go to Debugger -> Attach -> Remote GDB debugger)
  2. File -> Script File -> ida_bochs_windows.py

Done!

More info:

Some possible problems

How to solve Crash after resuming execution from gdb stub and/or crash after breakpoint:

The crash is in ulm.c

Without more details, part of it means that I'm guessing here, but there's a very high probability that it stands for "User Level Monitor" as it does elsewhere whenever VMware mentions "ulm".

As such that means your VM is running on a host with Hyper-V mode enabled.

That codepath is pretty new and is most likely why you are getting this issue.
The most likely workaround would be to disable Hyper-V mode at the host level.
This might not be an option for you though.

If it is then the steps to disable the Hyper-V role is to run the following command at the host in windows command-line with Administrator privileges:

bcdedit /set hypervisorlaunchtype off
Reboot the system to activate it.

If you want to go back to Hyper-V mode again, then you can enable it like this:

bcdedit /set hypervisorlaunchtype auto
 

hope this helps,

Demo video

https://youtu.be/q5MrGKqtmAg

Related

Helper script for Windows kernel debugging with IDA Pro on native Bochs debugger:

Helper scripts for windows debugging with symbols for Bochs and IDA Pro (PDB files). Very handy for user mode <--> kernel mode:

Helper script for Linux kernel debugging with IDA Pro on VMware + GDB stub (including some symbols helpers):

Credits

Based on original IDA-VMware-GDB By Oleksiuk Dmytro (aka Cr4sh) https://github.com/Cr4sh/IDA-VMware-GDB