Log in

View Full Version : IDA 6.1 and Bochs

deepzero
June 10th, 2013, 08:46
Hi,

i am trying to setup IDA PRO to run with Bochs, but no luck.

OS: xp sp3 x86 VM
IDA: IDA PRO 6.1 (leaked version, no way i can afford the real deal...yet)
Bochs: latest 2.6.2 (but i also tried some older versions)

Trouble starts when i try to setup Bochs. According to the bochs tutorial on the IDA homepage, i am suppsoed to speicify the path to bochdbg.exe in the advanced debugger options.
Tough luck, that option simply does not exist (see screenshot).

When i select IDB mode and try to run it anyways, i get two error messages ("failed to run bochs...", see screenshot). IDA freezes for several settings, dumps below text to the output and presents me with debugger settings (screenshot).
Ida output:


Quote:
Starting emulation at 40102E ending emulation at 40104E
00000000000i[ ] reading configuration from C:\Documents and Settings\admin\Desktop\custom.bochsrc
00000000000p[CTRL ] >>PANIC<< optional plugin 'vga_update_interval' not found
00000000000e[CTRL ] notify called, but no bxevent_callback function is registered
========================================================================
Bochs is exiting with the following message:
[CTRL ] optional plugin 'vga_update_interval' not found
========================================================================
00000000000i[CPU0 ] CPU is in real mode (active)
00000000000i[CPU0 ] CS.mode = 16 bit
00000000000i[CPU0 ] SS.mode = 16 bit
00000000000i[CPU0 ] EFER = 0x00000000
00000000000i[CPU0 ] | EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
00000000000i[CPU0 ] | ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000
00000000000i[CPU0 ] | IOPL=0 id vip vif ac vm rf nt of df if tf sf ZF af PF cf
00000000000i[CPU0 ] | SEG sltr(index|ti|rpl) base limit G D
00000000000i[CPU0 ] | CS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | DS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | SS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | ES:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | FS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | GS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | EIP=00000000 (00000000)
00000000000i[CPU0 ] | CR0=0x00000000 CR2=0x00000000
00000000000i[CPU0 ] | CR3=0x00000000 CR4=0x00000000
00000000000i[CTRL ] quit_sim called with exit code 1


Screenshot:

http://i.imgur.com/vUhess1.png

What do i do wrong? Wrong Bochs version?
As i said, ai tried a couple of older ones, too. Which version is advised for 6.1 use?


Hope someone can help me out here!

d.
Aimless
June 10th, 2013, 09:10
Hello,

Cannot make anything from your screenshots. They are too small and cannot be enlarged.

Perhaps a better screenshots?

Have Phun
deepzero
June 10th, 2013, 09:22
wired, it shows in full-res here.

try opening the link directly:

Quote:
http://i.imgur.com/vUhess1.png
deepzero
June 10th, 2013, 15:28
I read somewhere that bochs 252 is compatible with ida 6.1, so i tried that.

At first, bochs complained about an unknown parameter "pass" on line 38 of the boch cfg file. After commenting out the line, it now starts, displays the bochs windows, prints "Debugging with ida" and then pops up a messagebox:
Quote:

"Failed to inspect registers"


Followed by a termination of bochs and the "check parameters" dialog.

Hope somone can shed some light on all of this... :/
deepzero
June 10th, 2013, 15:48
Confirmed: bochs seems to work outside of IDA. It's just that ida pops up that damn "failed to inspect registers" error...
deepzero
June 11th, 2013, 02:37
Another one: Running IDA 6.1 with bohs 2.6 complains about a different "plugin" missing:



Quote:
Starting emulation at 409540 ending emulation at 40955D
00000000000i[ ] reading configuration from C:\\protection_id.bochsrc
00000000000e[ ] C:\\id.bochsrc:22: 'vga_update_interval' will be replaced by new 'vga: update_freq' option.
00000000000e[ ] C:\\id.bochsrc:24: 'keyboard_serial_delay' will be replaced by new 'keyboard' option.
00000000000e[ ] C:\\id.bochsrc:25: 'keyboard_paste_delay' will be replaced by new 'keyboard' option.
00000000000p[CTRL ] >>PANIC<< optional plugin 'pnic' not found
00000000000e[CTRL ] notify called, but no bxevent_callback function is registered
========================================================================
Bochs is exiting with the following message:
[CTRL ] optional plugin 'pnic' not found
========================================================================
00000000000i[CPU0 ] CPU is in real mode (active)
00000000000i[CPU0 ] CS.mode = 16 bit
00000000000i[CPU0 ] SS.mode = 16 bit
00000000000i[CPU0 ] EFER = 0x00000000
00000000000i[CPU0 ] | EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
00000000000i[CPU0 ] | ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000
00000000000i[CPU0 ] | IOPL=0 id vip vif ac vm rf nt of df if tf sf ZF af PF cf
00000000000i[CPU0 ] | SEG sltr(index|ti|rpl) base limit G D
00000000000i[CPU0 ] | CS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | DS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | SS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | ES:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | FS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | GS:0000( 0000| 0| 0) 00000000 00000000 0 0
00000000000i[CPU0 ] | EIP=00000000 (00000000)
00000000000i[CPU0 ] | CR0=0x00000000 CR2=0x00000000
00000000000i[CPU0 ] | CR3=0x00000000 CR4=0x00000000
00000000000i[CTRL ] quit_sim called with exit code 1



what's with those plugins? I cant find anything named "pnic".
deepzero
June 11th, 2013, 04:46
Solved: IDA 6.1 needs bochs 246!

Thanks @sandersu.
Aimless
June 11th, 2013, 06:36
So, help me out here --

After downloading BOCHS 246, you run the EXE that installs it -- Then you configure it in IDA -- and run everything in the bochs debugger --

Do I need to have a BOCHS image file and BIOS configured and THEN configure it in IDA -- or installing BOCHS out of the box and working in IDA will work?

is that right?

Or is there a step I am missing -- ??

Have Phun
deepzero
June 11th, 2013, 12:25
Depends on what you want to do, i guess.

If you just want to debug/emulate a piece of code or a PE file from your DB, IDA will generate a config + image automatically.
If you want to debug a BIOS, boot loader, etc. you'll ofcourse have to supply that.

At least in the first case, you have to configure aboslutely zero. IDA will even find the correct path on its own.
Aimless
June 12th, 2013, 05:55
Ahhh.... forget it.

Got it to work --- I was using the incorrect BOCHS versions.

Guess the 2.3+ of BOCHS you should be using instructions in hex-rays is incorrect.

Thanks deepzero, for the engagement.

Have Phun