1

In IDA, is it possible to convert placeholder data into a code segment?

In the end of the library I am working with, there is an uninitialized segment starting at 016AAB31.

The hex and actual data (which is question mark strings), however, does not allow me to put arm asm instructions into it, using the edit feature. It claims that it cannot convert the "????"s to hexadecimal integers.

Is there a way to extend the code segment to let me add more code, or any other way to do this? Thanks

Improve this question
1
  • 1
    Your uninitialized segment is probably a .bss segment, which basically means "I need 123456 bytes in ram, but because they are all initialized to 0, I won't inflate the executable by repeating 123456 zero bytes". So there's no space present in your file, and even if there was, your library relies on these bytes being 0, so you can't put anything there.
    – Guntram Blohm
    Dec 20, 2016 at 23:09

2 Answers 2

Reset to default
1

Edit > Segments > Create Segment

Improve this answer
3
  • I have tried this but it still does not let me do so, with the same error. In addition, even if I am able to get the code into there, (and label the segment as pure code) it does not transfer into instructions, only the hex characters that make up the instructions.
    – Aspire
    Feb 3, 2016 at 19:40
  • 1
    Have you actually told IDA that it's code? e.g. Select the address and hit C or invoke idc.MakeCode?
    – Zach Riggle
    Feb 3, 2016 at 22:05
  • 1
    Create segment has to do with segmentation registers in (mainly old, 16 bit) x86 code, and arm/thumb switches on arm, but nothing with executable file segments.
    – Guntram Blohm
    Dec 20, 2016 at 23:05
0

I would recommend against doing this in IDA. IDA is not a patching tool. Although there are plugins for IDA that implement this, there are far better choices for executable format editors, that are better equipped to add additional sections and manupulate data in it, which seems to be what you're after.

I suspect IDA won't be able to patch in the modified/new section even if you managed to create it. I think you'll have to use another tool for the job.

Since you're working with ARM assembly, I'll assume you're working on an executable in the elf format. For that, simply using objcopy --add-section would do the trick. You might also want to take a look at --set-section-flags afterwards.

More advanced tools include the eresi and radare projects. Both capable and designed to manipulate ELF executables to ease the work of a reverse engineer and/or security researcher.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.