1

I'm looking at a PE file that loads a bunch of strings and offsets into memory one after the other, and I was wondering whether there was any way to mark all of the dwords in a range of memory as offsets, and all references to chars in a range of memory as strings.

I could do each manually, but it seems like the kind of thing that you should be able to reanalyze during debug or that you should be able to collectively reclassify.

2

You can define the first one as an offset (o), then make the n dword(s) after it into an array (*) and enter the size, in dwords, of the list.

Untick "create as array" if you only want the dwords to be treated as offsets but do not want them to be grouped into one chunk. This would be the behaviour should you manually make them "offsets".

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.