正在加载视频...

视频加载失败

#IDA TIP to load #Windows #Kernel types: [1/2] Windows Kernel types (e.g., EPROCESS, ETHREAD, etc.) are not a part of the built-in IDA TILs (because they are changing across different WIN versions). 1. These types are a part of the "ntoskrnl.exe" debug symbols -> "ntkrnlmp.pdb". 2. IDA supports loading...

21,744 次观看 • 1 年前 •via X (Twitter)

3 条评论

Jiří Vinopal 的头像
Jiří Vinopal1 年前

[2/2] To quickly get specific version of "ntoskrnl.exe", #Winbindex ( is super helpful (credits to @m417z). Another credits go to @HexRaysSA and @IgorSkochinsky as they covered this in "Igor’s Tip of the Week" more than year ago:

bopin 的头像
bopin1 年前

Have you used IDA's TILs your made? idaclang.exe generate one til file from parsing .h header. I sufferred from some trouble

Jiří Vinopal 的头像
Jiří Vinopal1 年前

yes😁Actually, this was generated by "idaclang.exe": Maybe the "Compilation Commands" here can be helpful:

相关视频