Skip to main content
Reverse Engineering

Return to Question

added 290 characters in body
Source Link
Kyuuri
Kyuuri
  • 1
  • 1

Introduction

I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called ".mydiff", I overwrote the previous file. I made sure the exe was still working without issues, and that the PE header was valid.

The problem

I opened my .i64 file (ida database) and clicked on file->load file->reload input file. The problem is that after doing this my new section is shown as "GAP" and the info (segment type, segment permissions, etc.) are all wrong.

What I tried

Attempt #1

To make sure I didn't do a mistake I copied my exe into a new folder, opened it with IDA and waited for the auto-analysis to finish (generating a new database). I checked the segment and all the info was correct, the name was loaded correctly, the segment type, segment permissions, etc. were all loaded correctly.

The problem with this attempt is that I cannot continue using this database because that would mean I lose all the progress I made the past 2 months, all my comments, structs, local types, etc.

Attempt #2

I googled a lot (I'm not sure why but it's hard to find good info about ida) and found people mentioning that you can manually create a segment in IDA. I followed the steps, put the proper addresses, name and class.

The problem with this attempt is that the information about the segment is not complete at all. Compared to Attempt #1 (generating the db again) the segment had a lot of missing information.

Attempt #3

Clicked on option->general->analysis->reanalyze program. If I don't reload the input file before the reanalysis the new section is not shown. If I reload the input file before the reanalysis the new section is shown but all its info is wrong, exactly like in Attempt #1.

My question

What would be the proper way to make sure IDA loads this new segment correctly (or reloads the entire file) without losing any of my comments, structs, etc. I made the past few months?

Introduction

I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called ".mydiff", I overwrote the previous file. I made sure the exe was still working without issues, and that the PE header was valid.

The problem

I opened my .i64 file (ida database) and clicked on file->load file->reload input file. The problem is that after doing this my new section is shown as "GAP" and the info (segment type, segment permissions, etc.) are all wrong.

What I tried

Attempt #1

To make sure I didn't do a mistake I copied my exe into a new folder, opened it with IDA and waited for the auto-analysis to finish (generating a new database). I checked the segment and all the info was correct, the name was loaded correctly, the segment type, segment permissions, etc. were all loaded correctly.

The problem with this attempt is that I cannot continue using this database because that would mean I lose all the progress I made the past 2 months, all my comments, structs, local types, etc.

Attempt #2

I googled a lot (I'm not sure why but it's hard to find good info about ida) and found people mentioning that you can manually create a segment in IDA. I followed the steps, put the proper addresses, name and class.

The problem with this attempt is that the information about the segment is not complete at all. Compared to Attempt #1 (generating the db again) the segment had a lot of missing information.

My question

What would be the proper way to make sure IDA loads this new segment correctly (or reloads the entire file) without losing any of my comments, structs, etc. I made the past few months?

Introduction

I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called ".mydiff", I overwrote the previous file. I made sure the exe was still working without issues, and that the PE header was valid.

The problem

I opened my .i64 file (ida database) and clicked on file->load file->reload input file. The problem is that after doing this my new section is shown as "GAP" and the info (segment type, segment permissions, etc.) are all wrong.

What I tried

Attempt #1

To make sure I didn't do a mistake I copied my exe into a new folder, opened it with IDA and waited for the auto-analysis to finish (generating a new database). I checked the segment and all the info was correct, the name was loaded correctly, the segment type, segment permissions, etc. were all loaded correctly.

The problem with this attempt is that I cannot continue using this database because that would mean I lose all the progress I made the past 2 months, all my comments, structs, local types, etc.

Attempt #2

I googled a lot (I'm not sure why but it's hard to find good info about ida) and found people mentioning that you can manually create a segment in IDA. I followed the steps, put the proper addresses, name and class.

The problem with this attempt is that the information about the segment is not complete at all. Compared to Attempt #1 (generating the db again) the segment had a lot of missing information.

Attempt #3

Clicked on option->general->analysis->reanalyze program. If I don't reload the input file before the reanalysis the new section is not shown. If I reload the input file before the reanalysis the new section is shown but all its info is wrong, exactly like in Attempt #1.

My question

What would be the proper way to make sure IDA loads this new segment correctly (or reloads the entire file) without losing any of my comments, structs, etc. I made the past few months?

Source Link
Kyuuri
Kyuuri
  • 1
  • 1

How do I force IDA to reload PE Header and/or segments?

Introduction

I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called ".mydiff", I overwrote the previous file. I made sure the exe was still working without issues, and that the PE header was valid.

The problem

I opened my .i64 file (ida database) and clicked on file->load file->reload input file. The problem is that after doing this my new section is shown as "GAP" and the info (segment type, segment permissions, etc.) are all wrong.

What I tried

Attempt #1

To make sure I didn't do a mistake I copied my exe into a new folder, opened it with IDA and waited for the auto-analysis to finish (generating a new database). I checked the segment and all the info was correct, the name was loaded correctly, the segment type, segment permissions, etc. were all loaded correctly.

The problem with this attempt is that I cannot continue using this database because that would mean I lose all the progress I made the past 2 months, all my comments, structs, local types, etc.

Attempt #2

I googled a lot (I'm not sure why but it's hard to find good info about ida) and found people mentioning that you can manually create a segment in IDA. I followed the steps, put the proper addresses, name and class.

The problem with this attempt is that the information about the segment is not complete at all. Compared to Attempt #1 (generating the db again) the segment had a lot of missing information.

My question

What would be the proper way to make sure IDA loads this new segment correctly (or reloads the entire file) without losing any of my comments, structs, etc. I made the past few months?