Entrypoint search paddr

Wenzel / pyvmidbg

LibVMI-based debug server, implemented in Python. Building a guest aware, stealth and agentless full-system debugger

GNU General Public License v3.0

217 stars 25 forks source link

Entrypoint search paddr #22

Closed Wenzel closed 5 years ago

Wenzel commented 5 years ago

As ETHREAD.StartAddress is not mapped yet in the new process, we have to search in other process for the corresponding paddr. (pagefault injection doesn't work)

Then we set a breakpoint there and continue