i am studying an aslr enabled dll. in order to keep navigation simple, i rebased the dll to 0x0 so that i could jump simply by offsets.
now, when i attach to the process and place a bp, i get: WaitForEvent() failed; please make sure that all unresolved bpts/expressions could be evaluated before continuing.
when i disable the bp, i can run fine. in disassembly window, i see address values are pure offsets. i’m guessing the rabase caused this issue.
how can i make ida update the address upon attach?
the dll is VMP protected and i don’t want/need to go through hassle of bypassing its CRC to disable aslr; any tips on efficiently coping with dynamic addresses?
The database and breakpoints should be rebased automatically once the DLL is loaded into the debugged process. Please ensure that the file path or at least the filename in Debugger > Process options > Input file matches the DLL at runtime. It may also help to make the breakpoints module-relative and not absolute.
well the problem is that i dumped a packed dll and didn’t fix it to be run. the database is created based on this dumped dll. when i try attaching IDA, i get the error “database is too old to be used for rebasing“.
will manual rebase do just fine?