2

I have loaded a binary file into IDA which is for Motorola 6800 series.

  • The strings are referenced like this: pea ($2017A99).l. The actual address of the referenced string in above command is 0x017A99.

  • Functions are called like this:

    lea     ($200CA4C).l,a3
    jsr     (a3)
    

    or like this:

    jsr     $200CA4C
    

    where in both cases, the actual address of the function is 0x0CA4C.

    IDA pro didn't detect any of those and didn't add anything to xrefs or other reference lists.

Now my question is how can I modify string reference and function call detection process of IDA so they can be detected ?

Regards.

2

I might be wrong, but it sounds to me like you loaded the binary file at the wrong imagebase. It sounds like you loaded it at the default base address of 0x0, whereas the base address really ought to be 0x2000000. Load the file into IDA again from scratch and try putting 0x2000000 in the "Loading offset" box on the initial "Load a new file" dialog box.

As for why I think that: based on your examples, e.g. the second one:

jsr     $200CA4C

You're claiming the real address is 0x0CA4C, a difference of 0x2000000 from what's displayed. Your first example also differs by 0x2000000. So I'm guessing those instructions have hard-coded addresses in them, with all of them just above 0x2000000. That tells me the binary probably expects to be loaded at that address, which is why I'm advising you to try loading it at that address and see what happens.

  • Hi, thanks for your reply, I have edited the first question so it contains my answers to your suggestion. – Gholi GholiZade Mar 20 '18 at 16:59
  • Your question is now completely different. As written, my original response is no longer appropriate for what you are asking currently, even if it mostly solved your original problem. You should have asked a new question instead of drastically editing your existing one. – Rolf Rolles Mar 20 '18 at 17:22
  • Hi again, I undid the changes on the first question, and will create a new question. Thanks for your help. – Gholi GholiZade Mar 20 '18 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.