1

enter image description here

enter image description here

I can't see the _set_app_type function name in the CFF explorer , Why is that ?

1
  • Both has same call instruction at same mem location (as expected). Just the representation is different.
    – Biswapriyo
    May 15, 2018 at 8:15

1 Answer 1

1

The name isn't part of the code. IDA parses the import directory to get that informationen and then uses it to make the disassembly more readable. CFF Explorer doesn't seem to do that.

4
  • Thanks a lot .I have only used IDA pro , PE explorer and CFF explorer to view the disassembled code , CFF explorer is a bit of a disappointment then .
    – KpaK
    May 15, 2018 at 4:59
  • @wikilol those tools have different use-cases. Comparing them is a bit stupid. CFF explorer has this Quick disassembler for convenience. It's PE editor. IDA is a fully fledged disassembler/debugger. May 15, 2018 at 6:14
  • OK , I think i am stuck again , i thought with some application i can see the entire function in the disassembled code , just read about ltrace and strace for linux , let me see if i can find a windows equivalent ...Thanks for the reply everyone :)
    – KpaK
    May 15, 2018 at 17:08
  • @wikilolthen you see, your question should not be about CFF but what is an alternative for IDA I guess; reverseengineering.stackexchange.com/questions/1817/… May 16, 2018 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.