SinaKarvandi

start path "C:\Windows\notepad.exe"
g
? .thread_intercept_thread = 0;
? .target_pid = $pid;
? .target_tid = 0;
? .target_allocation_address = 0;
? .target_allocation_size = 0;
? .is_commited = 0;

!sysret stage post script {

SinaKarvandi

#include "HypervisorBypass.h"
#include <ntddk.h>

//
// Global Variables
//

PVOID NmiRegPointer;

BOOLEAN

SinaKarvandi

------------------------------------------------------------------
- Usage :
	 These commands show how you can use Windbg2IDA.

	-	!windbg2ida_run_until_ret [FileToSaveDump]

		Description : Run the program until it reaches to the ret instruction of current function.
			+ [FileToSaveDump] : The path to save the dump which can be use later by IDA.

		 e.g : !windbg2ida_run_until_ret "c:\\users\\sina\\desktop\\dump1.w2i"