What exactly is a Netnode? What are they used for and how can I manipulate them with IDC or the SDK?
The online IDA SDK has an excellent description: https://www.hex-rays.com/products/ida/support/sdkdoc/netnode_8hpp.html
An IDA database is one large table of key/value pairs.
All keys associated with a single address together form a
There are two kinds of netnodes:
- related to addresses associated with the binary loaded in ida.
- for internal items, these are used to store structs, stack-frames, enums, scripts, etc.
These internal items usually have addresses which start with
Because of this it can be a bit of a challenge to reverse engineer binaries which happen to use that address range.