Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

#IDA TIP to load #Windows #Kernel types: [1/2] Windows Kernel types (e.g., EPROCESS, ETHREAD, etc.) are not a part of the built-in IDA TILs (because they are changing across different WIN versions). 1. These types are a part of the "ntoskrnl.exe" debug symbols -> "ntkrnlmp.pdb". 2. IDA supports loading...

21,737 Aufrufe • vor 1 Jahr •via X (Twitter)

3 Kommentare

Profilbild von Jiří Vinopal
Jiří Vinopalvor 1 Jahr

[2/2] To quickly get specific version of "ntoskrnl.exe", #Winbindex ( is super helpful (credits to @m417z). Another credits go to @HexRaysSA and @IgorSkochinsky as they covered this in "Igor’s Tip of the Week" more than year ago:

Profilbild von bopin
bopinvor 1 Jahr

Have you used IDA's TILs your made? idaclang.exe generate one til file from parsing .h header. I sufferred from some trouble

Profilbild von Jiří Vinopal
Jiří Vinopalvor 1 Jahr

yes😁Actually, this was generated by "idaclang.exe": Maybe the "Compilation Commands" here can be helpful:

Ähnliche Videos