Skip to main content
Reverse Engineering

Return to Question

changed DDP to DPP
Source Link
r00kie
r00kie
  • 13
  • 5

Upon performing a disassembly of a binary, I noticed that many of the subroutines have the wrong offset for the address. It seems that the byte preceding the 2 byte address is wrong. For example, in the screenshot below, the disassembly indicates the functions should be at 0xA5C1E and 0xA5BCA. I've double checked the raw hex dump and confirmed that there is an "A" byte before the 2 byte address. It's also interesting to note that addresses which start with "A" are impossible in this binary since it's only 0x7FFFF in length. Based on experience from other binaries, I know the true addresses for these functions should be 0x25C1E and 0x25BCA, respectively. I can also confirm that I have subroutines which start at these locations.

enter image description here

I've disassembled other binaries (different application, same processor) and this problem didn't appear. However, every binary I've disassembled from this application shows this problem.

Is there a way to correct this in IDA Pro? Does it have anything to do with my DDPDPP register values?

Upon performing a disassembly of a binary, I noticed that many of the subroutines have the wrong offset for the address. It seems that the byte preceding the 2 byte address is wrong. For example, in the screenshot below, the disassembly indicates the functions should be at 0xA5C1E and 0xA5BCA. I've double checked the raw hex dump and confirmed that there is an "A" byte before the 2 byte address. It's also interesting to note that addresses which start with "A" are impossible in this binary since it's only 0x7FFFF in length. Based on experience from other binaries, I know the true addresses for these functions should be 0x25C1E and 0x25BCA, respectively. I can also confirm that I have subroutines which start at these locations.

enter image description here

I've disassembled other binaries (different application, same processor) and this problem didn't appear. However, every binary I've disassembled from this application shows this problem.

Is there a way to correct this in IDA Pro? Does it have anything to do with my DDP register values?

Upon performing a disassembly of a binary, I noticed that many of the subroutines have the wrong offset for the address. It seems that the byte preceding the 2 byte address is wrong. For example, in the screenshot below, the disassembly indicates the functions should be at 0xA5C1E and 0xA5BCA. I've double checked the raw hex dump and confirmed that there is an "A" byte before the 2 byte address. It's also interesting to note that addresses which start with "A" are impossible in this binary since it's only 0x7FFFF in length. Based on experience from other binaries, I know the true addresses for these functions should be 0x25C1E and 0x25BCA, respectively. I can also confirm that I have subroutines which start at these locations.

enter image description here

I've disassembled other binaries (different application, same processor) and this problem didn't appear. However, every binary I've disassembled from this application shows this problem.

Is there a way to correct this in IDA Pro? Does it have anything to do with my DPP register values?

Source Link
r00kie
r00kie
  • 13
  • 5

Correcting subroutine offset in IDA Pro

Upon performing a disassembly of a binary, I noticed that many of the subroutines have the wrong offset for the address. It seems that the byte preceding the 2 byte address is wrong. For example, in the screenshot below, the disassembly indicates the functions should be at 0xA5C1E and 0xA5BCA. I've double checked the raw hex dump and confirmed that there is an "A" byte before the 2 byte address. It's also interesting to note that addresses which start with "A" are impossible in this binary since it's only 0x7FFFF in length. Based on experience from other binaries, I know the true addresses for these functions should be 0x25C1E and 0x25BCA, respectively. I can also confirm that I have subroutines which start at these locations.

enter image description here

I've disassembled other binaries (different application, same processor) and this problem didn't appear. However, every binary I've disassembled from this application shows this problem.

Is there a way to correct this in IDA Pro? Does it have anything to do with my DDP register values?