can1357 / ntrays Goto Github PK

Since this is domain specific to NT Kernels, you could make it so that literal values (e.g. 0x80000000) are a drop down form menu containing various defines or enumeration values that match it. I don't know if it's possible with the IDA plugin API but it could be helpful.

What theme are you using?

@Eagle1020 and I found that NtRays will corrupt some decompilation results, e.g. ntoskrnl!KeYieldProcessorEx:

Without NtRays:

With NtRays:

This bug is possibly related to the alignment. After I patched the align 2 to nop nop, the result became correct.

With IDA 8.2.230124/8.3.230608 and NtRays64.dll v1.67 (hash 38234666299b9e94ba98d55462da39c7f764d839f6555d03b346226b412e22e6), I cannot rebase ntoskrnl.exe.

Repro Steps

1. Go to Edit -> Segments -> Rebase Program
2. Rebase image to address 0
3. Click OK
4. Nothing happens. It doesn't even print in the console that it's attempting to rebase the program.