0

So i dumped a PE file after it was unpacked, but the problem is it references another section in the memory map, so i dumped that section and added it to IDA just like this question :

IDA Pro - Load data in manually created segment

and set the segment as read write, everything seems fine

but it seems like the change is not reflected in the binary during execution, because even tho i can see the segment content and it seems fine, any instruction that tries to access this segment will raise an exception as if there is no segment there :

456BAD: The instruction at 0x456BAD referenced memory at 0x19A650. The memory could not be read -> 0019A650 (exc.code c0000005, tid 756)

but even during execution i can see that the content of the memory address 0x19A650 is fine, i think this might be because the binary is not changed or something, but how can i do that? tried saving patches or reloading the database and saving but didnt work!

checked the segment access rights and its read write as well

1

When debugging, IDA uses the actual content of the memory as well as the runtime memory layout and permissions. If the data you loaded into the IDB is not present at runtime, or loaded at a different address/permissions, it will be ignored.

Just because you added something to the IDB will not make it appear magically in the debugger, since the OS uses the data from the file on disk and doesn't know anything about IDB. The only exception to this is the Bochs debugger IDB mode which does use data from IDB, but it's a pretty limited emulation environment which is not suitable for debugging full executables.

| improve this answer | |
  • but is there a way i can use the data during runtime other than emulation? it doesnt seem that complicated to implement, IDA just needs to use some virtualAlloc and writememory stuff after the process is loaded, i can write the code myself, but whats the point for IDA to add the option of adding segments if its not reflected during execution? – Notoriouss Apr 27 at 3:43
  • The point of loading additional data into IDB is to help with the static analysis. Debugger shows what's happening in the OS/program at runtime and does only minimal changes to the environment to make debugging possible. When you run a program normally, the OS does not inject extra data on its own, and the debugger should not either. – Igor Skochinsky Apr 28 at 10:44
  • I still don't get why shouldn't debugger do this and why its hard for them to implement? considering many analysts may dump an unpacked PE which uses references to different injected modules, so how can i solve this problem then? – Notoriouss Apr 29 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.