1

I am working with a dumped program, and I essentially want to load it into IDA without performing any (relocation) address fixups. Is there a way to do this?

I have tried the following without success:
1. Manually loading it, and choosing not to load the .reloc section
2. Rebasing the image base to zero

1
  • Maybe load it as a binary file, and then split into segments using a bit of .py or .idc script. May 27 '18 at 8:46
2

environment variable IDA_NORELOC might work.

0

Rename the ".reloc" section, if IDA can't find it, it can't relocate the image.

0

I found that if I chose a load address manually, IDA would offset these references by whatever address I chose. If I didn't choose a load address manually, then IDA wouldn't change those references, so then all I needed to do was rebase the program without performing fixups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.