0

I have disassembled the exe in IDA 6.1 and I think I found a hand full of text files and was wondering how to go about dialing into the addresses and extracting the data. Here is what I found enter image description here

I know how to code a bit in C and .net and thought maybe it would be possible with guidance. Thanks in advance

Improve this question
1
  • 1
    I found a program that extracts all bits of texts but the demo is very limited. Word Extractor. what works works well
    – William Henson
    Commented Jan 11, 2016 at 6:15

2 Answers 2

Reset to default
2

It appears to me as if these are just file names, which may or may not refer to files embedded in the executable. Looking at the cross references and the surrounding API calls might tell you how they are being used.

Perhaps using a utility like strings might help to discover if there is more embedded text. If you think the files might be obfuscated you could try Didier Steven's xorsearch tool.

Improve this answer
1
  • I have scoured the accompanying files using Word extract and hex editors. there is no mention of such files except for inside the .exe. And when I say scoured I mean the find utility and manually searching. Still downloaded xorsearch. Thank you.
    – William Henson
    Commented Jan 12, 2016 at 2:52
1

Have you tried using IDAPython? Recently Palo Alto's special team, Unit42, started a series of articles about using it to help in binary analysis. It doesn't cover exactly what you're looking for, but it might give you some ideas:

Using IDAPython to Make Your Life Easier: Part 1
Using IDAPython to Make Your Life Easier: Part 2
Using IDAPython to Make Your Life Easier: Part 3
Using IDAPython to Make Your Life Easier: Part 4

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.