1

Excuse any ignorance, I'm new to IDA/re.

I'm following this tutorial here: https://ketansingh.net/hacking-games-with-dll-injection/

In the tutorial when he checks the functions with IDA they are all named with actual names, but when I check the functions they are all named seg_address. Can anyone tell me what the reason for this is? Can I get a plugin? Or is there some setting that is the reason? I've done some googling but haven't really found anything.

Thanks in advance for any help.

1

Most real-world programs on Windows do not include symbols in the binary, so IDA is not able to show function names (except for imports from other DLLs which have names, or compiler library functions identified by FLIRT). However, most of the binaries shipped with Windows do have separate symbols available on Microsoft's public symbol servers. So in cases where such symbols exist on the symbol server, IDA may be able to download them and recover names. If this is a non-Microsoft program or the symbols are missing for whatever reason, you won't get names and will have to reverse-engineer the functionality of the program by studying its code.

1

When opening Minesweeper inside of IDA from the directory C:\Program Files\Microsoft Games\Minesweeper IDA should display a dialog asking to grab PDB files. Click 'Yes' and you'll get the names of most of the functions.

If however the PDB is not found, an alternative method for finding the PDB file is to use Microsoft's SymChk tool which downoads the appropriate PDB for a given file. It's available with the Window debugging tools.

More Information: https://en.wikipedia.org/wiki/Program_database

  • Thanks a lot for your time and help. I figured the pdb was probably why, but in the repo that the tutorial uses it isn't included. So is it just that the author didn't include it? I also tried what you said but IDA can't find the pdb so it asks for me to locate the file, which I don't believe is included. So I'm basically out of luck? Thanks again. – tree Feb 25 '17 at 4:27
  • Please edit your question for the additional information, answers should be used for answers. – kennytm Feb 25 '17 at 6:49
  • 1
    This does not provide an answer to the question. Once you have sufficient reputation you will be able to comment on any post; instead, provide answers that don't require clarification from the asker. - From Review – perror Feb 25 '17 at 9:44
  • @tree As Igor said, it depends on the binary. Assuming this is an original binary from Microsoft, the PDB file should be available on their servers. Check out my edit detailing another way of finding PDB files. – Michael Kiros Feb 25 '17 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.