Skip to main content
Fixup of bad MSO links to MSE links migration
Source Link

You've got some kind of XY-problem.

The truth is: it's IDA who so to say "changes""changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?

Thus, you have at least three ways of dealing with your problem:

  • pray and hope that IDA's FLIRT will heuristically recognize printf;
  • link your program with debug-info: -debug which tells linker to generate pdb-file which IDA will query for all the symbols stored for your application;
  • tell linker to -export:printf so that it's name will be in export directory and you can get it's address easily even programmatically.

You've got some kind of XY-problem.

The truth is: it's IDA who so to say "changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?

Thus, you have at least three ways of dealing with your problem:

  • pray and hope that IDA's FLIRT will heuristically recognize printf;
  • link your program with debug-info: -debug which tells linker to generate pdb-file which IDA will query for all the symbols stored for your application;
  • tell linker to -export:printf so that it's name will be in export directory and you can get it's address easily even programmatically.

You've got some kind of XY-problem.

The truth is: it's IDA who so to say "changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?

Thus, you have at least three ways of dealing with your problem:

  • pray and hope that IDA's FLIRT will heuristically recognize printf;
  • link your program with debug-info: -debug which tells linker to generate pdb-file which IDA will query for all the symbols stored for your application;
  • tell linker to -export:printf so that it's name will be in export directory and you can get it's address easily even programmatically.
Migration of MSO links to MSE links
Source Link

You've got some kind of XY-problemXY-problem.

The truth is: it's IDA who so to say "changes""changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?

Thus, you have at least three ways of dealing with your problem:

  • pray and hope that IDA's FLIRT will heuristically recognize printf;
  • link your program with debug-info: -debug which tells linker to generate pdb-file which IDA will query for all the symbols stored for your application;
  • tell linker to -export:printf so that it's name will be in export directory and you can get it's address easily even programmatically.

You've got some kind of XY-problem.

The truth is: it's IDA who so to say "changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?

Thus, you have at least three ways of dealing with your problem:

  • pray and hope that IDA's FLIRT will heuristically recognize printf;
  • link your program with debug-info: -debug which tells linker to generate pdb-file which IDA will query for all the symbols stored for your application;
  • tell linker to -export:printf so that it's name will be in export directory and you can get it's address easily even programmatically.

You've got some kind of XY-problem.

The truth is: it's IDA who so to say "changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?

Thus, you have at least three ways of dealing with your problem:

  • pray and hope that IDA's FLIRT will heuristically recognize printf;
  • link your program with debug-info: -debug which tells linker to generate pdb-file which IDA will query for all the symbols stored for your application;
  • tell linker to -export:printf so that it's name will be in export directory and you can get it's address easily even programmatically.
Source Link
qwm
  • 176
  • 2

You've got some kind of XY-problem.

The truth is: it's IDA who so to say "changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers?

Thus, you have at least three ways of dealing with your problem:

  • pray and hope that IDA's FLIRT will heuristically recognize printf;
  • link your program with debug-info: -debug which tells linker to generate pdb-file which IDA will query for all the symbols stored for your application;
  • tell linker to -export:printf so that it's name will be in export directory and you can get it's address easily even programmatically.