Windbg + IDA：计算模块中的地址
我正在远程调试 Windows XP 机器。我的一个驱动程序加载到地址 0xb2c4c000 到 0xb2cb9680。
现在，当我在IDA中打开驱动程序时，我想要设置断点的偏移量是00017619。
如何有效地将我的IDA地址与windbg匹配？
我已经尝试了显而易见的方法，即对 0xb2c4c000 + 00017619 = 0xB2C635F7 求和，并使用 Windbg 中的“u”命令反汇编该地址。但结果与IDA中的汇编结果不符。
附带问题：有没有办法取消在 Windbg 中运行的命令？有几次我运行了需要很长时间才能处理的命令，我希望能够在需要时取消它们。这样我就可以继续工作了。
感谢您抽出时间。
I'm debugging remotely a windows XP machine. One of my drivers is loaded at address 0xb2c4c000 up to 0xb2cb9680.
Now when I open my driver in IDA, the offset I want to set a breakpoint on is at 00017619.
How can I effectively match my IDA address into windbg?
I've tried the obvious which is to sum 0xb2c4c000 + 00017619 = 0xB2C635F7 and disassemble that address using the 'u' command in windbg. But the results did not match the assembly in IDA.
On the side question: is there a way to cancel a command that is running in windbg? Several times I've ran commands that took ages to process, I would like to be able to cancel them if needed. So I can keep working.
Thanks for your time.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
IDA Pro 的最新版本允许您通过其 WinDbg 调试器插件来调试设备驱动程序。
另一种选择是您可以重新设置数据库的基础以匹配加载模块的基础，这样您就可以在 idb 和 Windbg 会话之间建立一对一的映射。
The recent versions of IDA Pro allow you to debug device drivers through its WinDbg debugger plugin.
Another alternative is that you can rebase your database to match the base of the loaded module and like that you have one to one mapping between idb and windbg session.
您添加错误。由于 IDA 假定 10000 作为入口点，正确的添加方法是
0xb2c4c000 + 00007619（减去 10000）
You are adding incorrectly. Since IDA assumes 10000 as Entry point correct way to add is
0xb2c4c000 + 00007619 (10000 is substracted)