Results 1 to 10 of 10

Thread: IDA 6.1 and Bochs

  1. #1

    [solved] IDA 6.1 and Bochs

    Hi,

    i am trying to setup IDA PRO to run with Bochs, but no luck.

    OS: xp sp3 x86 VM
    IDA: IDA PRO 6.1 (leaked version, no way i can afford the real deal...yet)
    Bochs: latest 2.6.2 (but i also tried some older versions)

    Trouble starts when i try to setup Bochs. According to the bochs tutorial on the IDA homepage, i am suppsoed to speicify the path to bochdbg.exe in the advanced debugger options.
    Tough luck, that option simply does not exist (see screenshot).

    When i select IDB mode and try to run it anyways, i get two error messages ("failed to run bochs...", see screenshot). IDA freezes for several settings, dumps below text to the output and presents me with debugger settings (screenshot).
    Ida output:


    Starting emulation at 40102E ending emulation at 40104E
    00000000000i[ ] reading configuration from C:\Documents and Settings\admin\Desktop\custom.bochsrc
    00000000000p[CTRL ] >>PANIC<< optional plugin 'vga_update_interval' not found
    00000000000e[CTRL ] notify called, but no bxevent_callback function is registered
    ========================================================================
    Bochs is exiting with the following message:
    [CTRL ] optional plugin 'vga_update_interval' not found
    ========================================================================
    00000000000i[CPU0 ] CPU is in real mode (active)
    00000000000i[CPU0 ] CS.mode = 16 bit
    00000000000i[CPU0 ] SS.mode = 16 bit
    00000000000i[CPU0 ] EFER = 0x00000000
    00000000000i[CPU0 ] | EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
    00000000000i[CPU0 ] | ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000
    00000000000i[CPU0 ] | IOPL=0 id vip vif ac vm rf nt of df if tf sf ZF af PF cf
    00000000000i[CPU0 ] | SEG sltr(index|ti|rpl) base limit G D
    00000000000i[CPU0 ] | CS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | DS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | SS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | ES:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | FS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | GS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | EIP=00000000 (00000000)
    00000000000i[CPU0 ] | CR0=0x00000000 CR2=0x00000000
    00000000000i[CPU0 ] | CR3=0x00000000 CR4=0x00000000
    00000000000i[CTRL ] quit_sim called with exit code 1
    Screenshot:



    What do i do wrong? Wrong Bochs version?
    As i said, ai tried a couple of older ones, too. Which version is advised for 6.1 use?


    Hope someone can help me out here!

    d.
    Last edited by deepzero; June 11th, 2013 at 04:47.

  2. #2
    Hello,

    Cannot make anything from your screenshots. They are too small and cannot be enlarged.

    Perhaps a better screenshots?

    Have Phun
    Blame Microsoft, get l337 !!

  3. #3
    wired, it shows in full-res here.

    try opening the link directly:

    http://i.imgur.com/vUhess1.png

  4. #4
    I read somewhere that bochs 252 is compatible with ida 6.1, so i tried that.

    At first, bochs complained about an unknown parameter "pass" on line 38 of the boch cfg file. After commenting out the line, it now starts, displays the bochs windows, prints "Debugging with ida" and then pops up a messagebox:
    "Failed to inspect registers"
    Followed by a termination of bochs and the "check parameters" dialog.

    Hope somone can shed some light on all of this... :/

  5. #5
    Confirmed: bochs seems to work outside of IDA. It's just that ida pops up that damn "failed to inspect registers" error...

  6. #6
    Another one: Running IDA 6.1 with bohs 2.6 complains about a different "plugin" missing:



    Starting emulation at 409540 ending emulation at 40955D
    00000000000i[ ] reading configuration from C:\\protection_id.bochsrc
    00000000000e[ ] C:\\id.bochsrc:22: 'vga_update_interval' will be replaced by new 'vga: update_freq' option.
    00000000000e[ ] C:\\id.bochsrc:24: 'keyboard_serial_delay' will be replaced by new 'keyboard' option.
    00000000000e[ ] C:\\id.bochsrc:25: 'keyboard_paste_delay' will be replaced by new 'keyboard' option.
    00000000000p[CTRL ] >>PANIC<< optional plugin 'pnic' not found
    00000000000e[CTRL ] notify called, but no bxevent_callback function is registered
    ========================================================================
    Bochs is exiting with the following message:
    [CTRL ] optional plugin 'pnic' not found
    ========================================================================
    00000000000i[CPU0 ] CPU is in real mode (active)
    00000000000i[CPU0 ] CS.mode = 16 bit
    00000000000i[CPU0 ] SS.mode = 16 bit
    00000000000i[CPU0 ] EFER = 0x00000000
    00000000000i[CPU0 ] | EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
    00000000000i[CPU0 ] | ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000
    00000000000i[CPU0 ] | IOPL=0 id vip vif ac vm rf nt of df if tf sf ZF af PF cf
    00000000000i[CPU0 ] | SEG sltr(index|ti|rpl) base limit G D
    00000000000i[CPU0 ] | CS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | DS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | SS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | ES:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | FS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | GS:0000( 0000| 0| 0) 00000000 00000000 0 0
    00000000000i[CPU0 ] | EIP=00000000 (00000000)
    00000000000i[CPU0 ] | CR0=0x00000000 CR2=0x00000000
    00000000000i[CPU0 ] | CR3=0x00000000 CR4=0x00000000
    00000000000i[CTRL ] quit_sim called with exit code 1

    what's with those plugins? I cant find anything named "pnic".

  7. #7
    Solved: IDA 6.1 needs bochs 246!

    Thanks @sandersu.

  8. #8

    As Above

    So, help me out here --

    After downloading BOCHS 246, you run the EXE that installs it -- Then you configure it in IDA -- and run everything in the bochs debugger --

    Do I need to have a BOCHS image file and BIOS configured and THEN configure it in IDA -- or installing BOCHS out of the box and working in IDA will work?

    is that right?

    Or is there a step I am missing -- ??

    Have Phun
    Blame Microsoft, get l337 !!

  9. #9
    Depends on what you want to do, i guess.

    If you just want to debug/emulate a piece of code or a PE file from your DB, IDA will generate a config + image automatically.
    If you want to debug a BIOS, boot loader, etc. you'll ofcourse have to supply that.

    At least in the first case, you have to configure aboslutely zero. IDA will even find the correct path on its own.

  10. #10
    Ahhh.... forget it.

    Got it to work --- I was using the incorrect BOCHS versions.

    Guess the 2.3+ of BOCHS you should be using instructions in hex-rays is incorrect.

    Thanks deepzero, for the engagement.

    Have Phun
    Blame Microsoft, get l337 !!

Similar Threads

  1. Unpacking mpress’ed PE+ DLLs with the Bochs plugin
    By Hex Blog in forum Blogs Forum
    Replies: 0
    Last Post: July 3rd, 2011, 06:32
  2. Replies: 0
    Last Post: September 10th, 2009, 15:19
  3. Replies: 0
    Last Post: July 3rd, 2009, 14:18
  4. Bochs plugin goes alpha
    By Hex Blog in forum Blogs Forum
    Replies: 0
    Last Post: February 7th, 2009, 16:50
  5. Bochs Emulator and IDA?
    By Hex Blog in forum Blogs Forum
    Replies: 0
    Last Post: February 7th, 2009, 16:50

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •