首页
社区
课程
招聘
[分享]Bochs Emulator and IDA?
发表于: 2008-10-3 13:28 7329

[分享]Bochs Emulator and IDA?

2008-10-3 13:28
7329
转自:http://hexblog.com/2008/10/bochs_emulator_and_ida.html

The next version of IDA will be released with a bochs debugger plugin, and what is nice about is that you will be able to use it easily by just downloading bochs executables and telling IDA where to find it.

IDA's bochs debugger is a plugin that allow you to use bochs' emulation/debugger inside IDA's interface, but not just only that, but to make your debugging experience easier.

The plugin will come with three of the what we dubbed as "bochs loaders", so here is a brief explanation:

The first loader, disk image loader, is probably the most simple but yet the most powerful one. It allows you to debug any bochs image of your choice. For example, you could debug boot sector, 16 bit code, and perhaps debug 32 bit code all in the same debugging session. We actually use this bochs loader to debug other bochs loaders!

The second, idb loader, is a 32bit mode loader that allow you to debug anything within the database. The database will be your input file, thus whatever segments exist in the database, will be loaded and mapped into bochs' virtual memory. The idb loader understands and catches raw cpu exceptions and allows you to specify the startup stack segment's size.

Finally comes the pe loader, which is a specialized bochs loader, that will read your PE file and create a virtual environment similar to windows environment, trying to mimic basic demands for a PE file (import resolution, SEH, api emulation backed by IDC scripts).

This plugin is still under development, however we put a small video demonstrating the IDB loader.

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 221
活跃值: (10)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
2
good news
2008-10-4 11:00
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
2008-10-4 16:43
0
游客
登录 | 注册 方可回帖
返回
//