Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IDA+windbg: mod request has no match for ntkrnlmp.exe #120

Open
spokeex opened this issue May 28, 2024 · 1 comment
Open

IDA+windbg: mod request has no match for ntkrnlmp.exe #120

spokeex opened this issue May 28, 2024 · 1 comment

Comments

@spokeex
Copy link

spokeex commented May 28, 2024

Connection between windbg extension and ida plugin is made successfully.
Cannot set breakpoints, because "idb isn't enabled".

The only warning/error message I see in IDA, is "[sync] << broker << dispatcher msg: mod request has no match for ntkrnlmp.exe"

I'm attempting to debug a driver that has ntoskrnl imports, so maybe it has something to do with that.

Using IDA home 8.4.

EDIT:
I'm able to start a session with ntoskrnl.exe idb loaded. Then retsync seems to work. I'm still wondering how I can also load the driver Im interested in, into IDA and have that work.
I still have to try https://hex-rays.com/blog/several-files-in-one-idb/.

@luke0x90
Copy link

luke0x90 commented Aug 4, 2024

Have a look at the readme:
https://github.com/bootleg/ret-sync/blob/master/README.md?plain=1#L179

[ALIASES]
ntoskrnl_vuln.exe=ntkrnlmp.exe

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants