Recently I was trying to learn more about Windows Kernel. I downloaded right symbols
for my sys(win7 x64 free). I run IDA and open ntoskrnl.exe. IDA asked whether to attach pdb file. But most of functions were not resolved – sub_XXXXXX. So I ran Windbg, I unassembled randomly chosen function which has to be in ntoskrnl – KiSystemCall64. And it show output.
But there is no such function in IDA(or it was not resolved). To sum up, using the same symbols, functions which are unassembled in WinDBg, are not resolved(no sign of them) in IDA(and vice versa).
I would appreciate any help, suggestions from You.
Recently I was trying to learn more about Windows Kernel. I downloaded right symbols
Share
Did you analyze the module after you loaded symbols for it? In the Modules window, right click the kernel and choose “Load debug symbols.” After that’s done, right click the module again and choose, “Analyze module.”
-scott