The result is a pre-labeled IDB for you to explore and reverse engineer, after typing just one command in Volatility. Then, if you have idag.exe (Windows) or idal (Linux/OS X) in your $PATH, then it will create an IDB file from the extracted kernel driver and run the IDC script.

This will automatically detect which SSDT functions are hooked, extract the hooking kernel driver to disk, and generate an IDC file (IDA script) containing labels for the rootkit functions. If you want to explore SSDT hooks installed by rootkits, use the ssdt_ex command. Here is the description of the tools in Volatility freamwork

it has to be in ubuntu becasue once i but the directory of wine in tool, does not recognize it. I was able to install ida in wine but that was not help. I change Wine from 1.5.29 to 2.22 (usually better for all old apps). Note: we cannot possibly install & try IDA on all flavors/versions of all Linux distributions, but we will do our best to update this post with relevant information, whenever we learn of a distribution requiring special attention. It supports 64-bit Linux Ubuntu, macOS 10.13, and 64-bit Windows 10, as. I have Ubuntu 14.04 圆4 and I am running Ida pro V6.6 in virtual box in windows 8. Program, they still generously awarded us IDA Pro Linux and MAC version. Please, anyone knows how i can install IDA pro in Ubuntu? i am working with volatility freamwork forensic tools, and one of its tools need me to use ida IDA is a multi-processor disassembler and debugger. Is it possible to install IDA Pro without kowning installation.

Install ida pro linux ubuntu