View Single Post
  #4  
Old 12-14-2005, 22:40
JuneMouse
 
Posts: n/a
as you rightly say ollydbg is a user mode debugger so it cannot debug drivers
to debug drivers you need a kernel mode debugger if you are comfortable with softice then you can use that as others have recommended
else get windbg from microsoft (its free and consist of both and use mode debugger aks windbg.exe and a kernel mode debugger kdb)
to use kdb you would need two pcs connected through one would act as host and other client if you dont have two pcs you can install one of those virtual machine ware (vmware virtual pc ) and debug drivers

take a look at the link below for configuring vmware to be used as second pc

http://silverstr.ufies.org/lotr0/windbg-vmware.html

http://www.catch22.net/tuts/vmware.asp

though windbg and kdbs gui is kinda fuzzy to use at first if you get used to it
it proves to be an excellent debugger

if you dont want to debug but just analyze some functions statically (dead listing approach) then getting the file loaded into ida should do a nice job
or get livekd from sysinternals and use it in conjunction with windbg to poke
Reply With Quote