1

I think that this is a basic need of every reverser so this question may have been asked in other places but really, I'm unable to find an answer. Maybe I'm asking the wrong question.

So, supposing I have a DLL that change base VA among different execution because of ASLR, in windows I can set DLLCharacteristic to make sure is loaded every time at the same address (losing eventually the signature). But what for generic code?

Suppose that a program allocate a buffer, copy some data, decrypt it then run it. In IDA, of course I can take a snapshot of memory, analyze it, put label and so on, but if I run the program the second time chances are the address are changed, so I can't benefit of my previous analysis.

Is there a way map an arbiratry address with a previous analyzed section in the database?

|improve this question
1

To map your section to another address use Edit -> Segments and than Move current segment in IDA, you can even rebase the whole program in this menu.

I hope I have understood your question. Sorry if not :)

|improve this answer
  • 1
    It works like a charm. Sorry for the dumb question. I've always tried the opposite from the "program segmentation" view and it never worked. Thanks, this semplify a lot my work!! – Marco Ramsay Qualcuno Sep 25 '15 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.