View Full Version : ollydbg and sys files
h27
August 17th, 2006, 01:12
Is there any way to debug sys files by ollydbg?
autarky
August 17th, 2006, 02:06
Sys files are kernel mode components for Windows (typically some form of device driver). They are loaded and executed (so to speak) in ring 0. Olly is a ring 3 debugger, so it can't even access them. Well, technically it could using the native debug control API, but that's a bit naughty. Anyway, you need a ring 0 debugger to debug kernel mode code. The ones I have experience of are Syser, SoftICE, and WinDbg. There's at least one other that I can't remember the name of. There's a thread on ring 0 debuggers on OpenRCE. I prefer WinDbg nowadays.
LLXX
August 17th, 2006, 17:33
Quote:
[Originally Posted by autarky]There's at least one other that I can't remember the name of. |
TRW2000

h27
August 19th, 2006, 13:16
ok
so there is no way to use ollydbg?
TRW200 works under win98.
disavowed
August 19th, 2006, 17:27
Googling (http://www.google.com/search?hl=en&q=ollydbg+drivers ("http://www.google.com/search?hl=en&q=ollydbg+drivers")) yields http://blogs.msdn.com/geffner/archive/2006/08/17/704412.aspx ("http://blogs.msdn.com/geffner/archive/2006/08/17/704412.aspx") as the first hit. You can try using the method described there to load your sys file into OllyDbg, but it probably won't help you that much if you're trying to do real debugging.
blabberer
August 20th, 2006, 02:05
or you can use windbg and load the sys files as dump file look for doron holons blog in msdn a hole in my head
http://blogs.msdn.com/doronh/archive/2006/03/20/556053.aspx
well but like disa says all of them are usefull for preliminary analysis
and or tweking around
not usefull for real debugging
c0lo
August 21st, 2006, 10:41
very nice eh thx by links
Powered by vBulletin® Version 4.2.2 Copyright © 2020 vBulletin Solutions, Inc. All rights reserved.