Debug unsigned drive __ Tool

From: http://hi.baidu.com/abinhebaijie/item/b7953e432cc8c6a261d7b9e0

It seems that many people do not know how to dynamically debug unsigned drives.

First use any PE file information viewing tool to view the driver loaded base address, generally 0x10000, of course, you can also use Ida to see. Then use IDA to open the drive, look at the DriverEntry offset, and then use this offset minus the base address to get a. With WinDbg, the next breakpoint bu xxxx (module name) +a.

For example, the base address in Tessafe.sys is 0x01001000,driverentry offset is 0x01001005, the offset is 5, you can lower the breakpoint bu tessafe+5. You can debug it dynamically.