IDA不提示下载PDB

IDA不提示下载PDB

用IDA对dll进行静态分析是调试漏洞必不可少的步骤,今天在windwos上安装了IDA 6.8,分析wind32k.sys时,发现IDA不会自动去微软的服务器下载pdb文件了,导致整个dll只能识别出DriverEntry函数。最后找到解决办法是:修改ida安装目录下的pdb.cfg文件。

// PDB plugin

#ifdef __PC__                           // INTEL 80x86 PROCESSORS
//
// The downloaded symbols are stored in the specified directory.
// Microsoft's public symbol store is used for downloading the symbols.
//
// If this option is omitted or empty  - use _NT_SYMBOL_PATH if set, otherwise use %TEMP%\ida directory
// If the value is not empty           - use it

//PDBSYM_DOWNLOAD_PATH    = "c:\\symbols";

// Full symbol path (in _NT_SYMBOL_PATH format)
// If set, PDBSYM_DOWNLOAD_PATH and _NT_SYMBOL_PATH are ignored
PDBSYM_SYMPATH = 
//把下面这行的注释去掉,改成自己的本地符号路径就好了
"SRV*e:\\sym*http://symbols.mozilla.org/firefox;SRV*c:\\symbols*http://msdl.microsoft.com/download/symbols";

// remote server where win32_remote.exe is running
// used when loading PDB symbols on non-Windows platforms
// NB: it will be used only if there is not already an existing debugging session started
PDB_REMOTE_SERVER = "localhost";
PDB_REMOTE_PORT   = 23946
// password for the remote server
PDB_REMOTE_PASSWD = "";

#endif

重新加载dll,会自动去微软的服务器下载pdb文件,并存在本地的*e:\sym文件夹。

思考:继续深入了解IDA的话,有必要搞清楚

  1. IDA目录下的配置文件都是做什么用的
  2. 启动顺序如何
  3. 怎么修改
posted @ 2016-01-09 03:09  Lnju  阅读(2003)  评论(0编辑  收藏  举报