enter image description here

enter image description here

I can't see the _set_app_type function name in the CFF explorer , Why is that ?

  • Both has same call instruction at same mem location (as expected). Just the representation is different. – Biswapriyo May 15 '18 at 8:15

The name isn't part of the code. IDA parses the import directory to get that informationen and then uses it to make the disassembly more readable. CFF Explorer doesn't seem to do that.

  • Thanks a lot .I have only used IDA pro , PE explorer and CFF explorer to view the disassembled code , CFF explorer is a bit of a disappointment then . – KpaK May 15 '18 at 4:59
  • @wikilol those tools have different use-cases. Comparing them is a bit stupid. CFF explorer has this Quick disassembler for convenience. It's PE editor. IDA is a fully fledged disassembler/debugger. – Paweł Łukasik May 15 '18 at 6:14
  • OK , I think i am stuck again , i thought with some application i can see the entire function in the disassembled code , just read about ltrace and strace for linux , let me see if i can find a windows equivalent ...Thanks for the reply everyone :) – KpaK May 15 '18 at 17:08
  • @wikilolthen you see, your question should not be about CFF but what is an alternative for IDA I guess; reverseengineering.stackexchange.com/questions/1817/… – Paweł Łukasik May 16 '18 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.