-1

Why does this happen and how do I get to that place in file using IDA? I have found a unicode string using WinHEX. Now I would like to see from where is it referenced. I tried to jump on the file offset, but it prints out an error: Command "JumpFileOffset" failed. Searching for those bytes as well as for the text value yields no results. It's like IDA somehow missed that part of the file. Looking at IDA's hex-view the file ends with a lot of ?? bytes, whereas in WinHEX those offsets have all sorts of data: what looks like garbage and a lots of unicode strings.

It seems like there is some trivial knowledge I'm missing.

Improve this question

2 Answers 2

Reset to default
2

By default, IDA does not load all sections.

To force IDA to load all sections, check the Manual load checkbox when opening the file in IDA:

Manual load

However, note that this likely won't help you, since it's very unlikely that you'll find a cross-reference from that string back to the code. If the string is in a .rsrc section, look for calls to FindResource().

Improve this answer
1
  • That helps, thank you. I was able to put a read breakpoint on the string and find out what code uses it.
    – Stranger1399
    Commented Feb 23, 2016 at 14:15
0

Existing data on disk that appears in IDA as '??' bytes usually means that this data is overlay, i.e. it's behind the end of the last section. Check what should be the RVA of your string and whether it does land in a section or not depending on the header of your executable.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.