1

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff.

The parts of the program I am interested in is where it reads a file. This is a binary file that (I assume) goes into some data structure. I am trying to find out the binary format used in the file.

Is there some simple way to find the relevant parts of the code?

Edit: it is a Windows program, not very old, and I am using Linux (if that matters).

Improve this question
3
  • 1
    Hi and welcome to RE.SE! We usually avoid providing full solutions to specific problems where it appears OP spent little time trying to pursue the challenge themselves. The most basic thing to do in such a case would be finding references to I/O functions. Have you tried mapping the common file I/O functions and search for them in the program's import table(s)?
    – NirIzr
    Commented Jan 29, 2019 at 11:06
  • @Nirlzr: I have actually spent a bit of time on this, but by analysing the file, not the program. I was just wondering if there were any more specific (and thereby more useful) tools for this particular problem.
    – Tomas By
    Commented Jan 29, 2019 at 12:25
  • Could you share the link of that executable file?
    – Biswapriyo
    Commented Jan 30, 2019 at 4:09

1 Answer 1

Reset to default
1

You need to focus on imported functions which access to file. In your case it could be WinAPI (CreateFileA/W, ReadFile), libc (fopen, fread), libc++ (std::fstream, be careful about the name mangling), etc. However, the executable could also rely on 3rd parties DLL to do that. Then you can use the cross-references to see where your program calls these functions.

Improve this answer
2
  • Hmm, yes. At the moment I do not really know anything more about the program (ie which language), but that can be determined, I guess.
    – Tomas By
    Commented Jan 28, 2019 at 18:54
  • Yes, could you share the list of imported function?
    – wisk
    Commented Jan 29, 2019 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.