0

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff.

The parts of the program I am interested in is where it reads a file. This is a binary file that (I assume) goes into some data structure. I am trying to find out the binary format used in the file.

Is there some simple way to find the relevant parts of the code?

Edit: it is a Windows program, not very old, and I am using Linux (if that matters).

  • 1
    Hi and welcome to RE.SE! We usually avoid providing full solutions to specific problems where it appears OP spent little time trying to pursue the challenge themselves. The most basic thing to do in such a case would be finding references to I/O functions. Have you tried mapping the common file I/O functions and search for them in the program's import table(s)? – NirIzr Jan 29 at 11:06
  • @Nirlzr: I have actually spent a bit of time on this, but by analysing the file, not the program. I was just wondering if there were any more specific (and thereby more useful) tools for this particular problem. – Tomas By Jan 29 at 12:25
  • Could you share the link of that executable file? – Biswapriyo Jan 30 at 4:09
0

You need to focus on imported functions which access to file. In your case it could be WinAPI (CreateFileA/W, ReadFile), libc (fopen, fread), libc++ (std::fstream, be careful about the name mangling), etc. However, the executable could also rely on 3rd parties DLL to do that. Then you can use the cross-references to see where your program calls these functions.

  • Hmm, yes. At the moment I do not really know anything more about the program (ie which language), but that can be determined, I guess. – Tomas By Jan 28 at 18:54
  • Yes, could you share the list of imported function? – wisk Jan 29 at 3:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.