2

For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained or gave a link to explanation.

3
  • I mean in debug process I have interaction between two libraries(Lib1 calls Lib2) and at some point I am in a function that I am interested in. And I wanted to know is my function from Lib1 or Lib2. – funkadelic Oct 22 '19 at 6:41
  • doesn't ida show you the module if it is externali I think ida differentiates imports with pink color and sub is normally a prefix for a function that is within the module being analysed it iirc doesnt point to an external module (and icould havewritten an answer but your questionis still unclear evenafter your comment) – blabb Oct 22 '19 at 10:27
  • I didn't know that sub_ prefix is used for functions that belong to module that was analyzed. It makes sense now, because in most cases I generate function (with P hotkey) when I stop in the middle of unprocessed asm code(and new generated function also have sub_ prefix). Everything that wasn't processed at first doesn't belong to processed module :) Thanks for help – funkadelic Oct 23 '19 at 7:45
1

At debug time:

  • segments belonging to runtime-loaded DLLs are marked with their names (kernel32.dll etc.),
  • non-module areas (e.g. heap) have names like debug038,
  • segments coming from the IDB retain their original names,

so .text most likely belongs to the input .exe/.dll (whichever was used to create the IDB). You can also check the Modules view to see the start and size of each module in the process.

1
  • Thank you! I forgot that Modules view have Base and Size info because usually I minimize it in order to see only module name(for search purposes). Also, remark about .text segment was useful. – funkadelic Oct 23 '19 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.