{"id":16714103,"url":"https://github.com/therealdreg/ida_vmware_windows_gdb","last_synced_at":"2025-03-21T20:33:37.533Z","repository":{"id":44171949,"uuid":"511996560","full_name":"therealdreg/ida_vmware_windows_gdb","owner":"therealdreg","description":"Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)","archived":false,"fork":false,"pushed_at":"2023-08-11T06:26:44.000Z","size":189,"stargazers_count":63,"open_issues_count":1,"forks_count":13,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-03-18T05:06:54.181Z","etag":null,"topics":["debugging","gdb","ida-pro","idapython","kernel-debugging","osdev","pdb","reverse-engineering","vmware","vmware-workstation","windows"],"latest_commit_sha":null,"homepage":"https://rootkit.es/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/therealdreg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["therealdreg"],"patreon":"dreg","custom":["https://www.paypal.me/therealdreg","https://www.paypal.me/therealdreg"]}},"created_at":"2022-07-08T18:49:44.000Z","updated_at":"2025-01-31T02:08:22.000Z","dependencies_parsed_at":"2024-10-28T11:33:37.991Z","dependency_job_id":"fa2e8b0f-0823-455e-877b-c660347af45e","html_url":"https://github.com/therealdreg/ida_vmware_windows_gdb","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/therealdreg%2Fida_vmware_windows_gdb","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/therealdreg%2Fida_vmware_windows_gdb/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/therealdreg%2Fida_vmware_windows_gdb/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/therealdreg%2Fida_vmware_windows_gdb/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/therealdreg","download_url":"https://codeload.github.com/therealdreg/ida_vmware_windows_gdb/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244866379,"owners_count":20523506,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["debugging","gdb","ida-pro","idapython","kernel-debugging","osdev","pdb","reverse-engineering","vmware","vmware-workstation","windows"],"created_at":"2024-10-12T20:49:19.448Z","updated_at":"2025-03-21T20:33:37.140Z","avatar_url":"https://github.com/therealdreg.png","language":"Python","funding_links":["https://github.com/sponsors/therealdreg","https://patreon.com/dreg","https://www.paypal.me/therealdreg"],"categories":[],"sub_categories":[],"readme":"# ida_vmware_windows_gdb.py\nHelper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)\n\npython3 + idapython 7.4\n\n![kerneldebugida](img/kerneldebugida.PNG)\n\n# Usage\n\n**WARNING**: BEFORE OPEN IDA your must set env var: _NT_SYMBOL_PATH to windows symbols, ex: \n```\nSRV*C:\\winsymbols*\n```` \n\n1. Open IDA PRO, start a debug session (go to Debugger -\u003e Attach -\u003e Remote GDB debugger)\n2. File -\u003e Script File -\u003e ida_bochs_windows.py\n\nDone!\n\nMore info:\n- Advanced Windows Kernel Debugging with VMWare and IDA’s GDB debugger: https://hex-rays.com/blog/advanced-windows-kernel-debugging-with-vmware-and-idas-gdb-debugger/\n- IDA Help Debugging with VMWare: https://hex-rays.com/products/ida/support/idadoc/1357.shtml\n\n# Some possible problems\n\nHow to solve Crash after resuming execution from gdb stub and/or crash after breakpoint:\n\n```\nThe crash is in ulm.c\n\nWithout more details, part of it means that I'm guessing here, but there's a very high probability that it stands for \"User Level Monitor\" as it does elsewhere whenever VMware mentions \"ulm\".\n\nAs such that means your VM is running on a host with Hyper-V mode enabled.\n\nThat codepath is pretty new and is most likely why you are getting this issue.\nThe most likely workaround would be to disable Hyper-V mode at the host level.\nThis might not be an option for you though.\n\nIf it is then the steps to disable the Hyper-V role is to run the following command at the host in windows command-line with Administrator privileges:\n\nbcdedit /set hypervisorlaunchtype off\nReboot the system to activate it.\n\nIf you want to go back to Hyper-V mode again, then you can enable it like this:\n\nbcdedit /set hypervisorlaunchtype auto\n \n\nhope this helps,\n```\n\n- https://communities.vmware.com/t5/VMware-Workstation-Pro/Crash-after-resuming-execution-from-gdb-stub/td-p/2824667\n\n## Demo video\n\nhttps://youtu.be/q5MrGKqtmAg\n\n## Related \n\nHelper script for Windows kernel debugging with IDA Pro on native Bochs debugger:\n- https://github.com/therealdreg/ida_bochs_windows\n\nHelper scripts for windows debugging with symbols for Bochs and IDA Pro (PDB files). Very handy for user mode \u003c--\u003e kernel mode:\n- https://github.com/therealdreg/symseghelper\n\nHelper script for Linux kernel debugging with IDA Pro on VMware + GDB stub (including some symbols helpers):\n- https://github.com/therealdreg/linux_kernel_debug_disassemble_ida_vmware\n\n## Credits\n\nBased on original IDA-VMware-GDB By Oleksiuk Dmytro (aka Cr4sh) https://github.com/Cr4sh/IDA-VMware-GDB\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftherealdreg%2Fida_vmware_windows_gdb","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftherealdreg%2Fida_vmware_windows_gdb","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftherealdreg%2Fida_vmware_windows_gdb/lists"}