Fixing up data sections of a malware sample in IDA database?

Question

I have a piece of malware dumped by segments. A lot of the data section seems to be screwed up when loaded into IDA Pro.

First of all, pointers are stored in a single array which is incorrect. I want these to be separated and each value have their own pointer which I can xref across the db. Instead of seeing them accessed as array[ index ] which is too hard to keep track of and impossible to xref correctly.

Next, many floating point values ( represented in hex ) are stored like this instead of as a single hex number. I want these values to represent 0x3d4c0cc0cd ( 0.05 ).

I'm not all that familiar with IDA and I'm wondering if there is a way to fix this ( preferably in bulk instead of me having to go through each value one by one )

Answer 1

IDA, as an interactive disassembler allows you to change how data is displayed to fit the actual meaning and usage. Although IDA tries to infer data types (among other things) it is not always successful.

Generally, you can place the cursor on a data item or operand and either right click or use the Edit menu.

For example, to address your second issue and to set a data type to a floating point number you'll need to place your cursor on it and click the Edit->Operand->Number->Floating point submenu.

Your first issue is a little more tricky. If the code in front of you uses an offset in an array to get different pointers, there's no easy and clean way to hide that, and there shouldn't be.

Unlike the floating point case, this time IDA inferred data correctly, and I do not recommend hiding that information from the user (aka you). Instead, you may wanna write a short IDAPython script that would add comments according to the pointer used, as well as actually take the time to understand what those indices mean.

Creating a structure and applying it to the array, giving names to each offset, is something I often do. You can also create an enum with indices named by the pointer's function. If I misunderstood and IDA did infer the pointers array incorrectly please correct me and make it clearer in your question.