0

While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44:
enter image description here

I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes... (Alt+B) in IDA and searched for 680df44 but it didn't find this address:

Searching down CASE-INSENSITIVELY for binary pattern:
    44 DF 80 06
Search failed.
Command "AskBinaryText" failed

I thought maybe the order was incorrect so I change it to 40f40d68 and it still failed:

Searching down CASE-INSENSITIVELY for binary pattern:
    68 0D F4 40
Search failed.
Command "AskBinaryText" failed
  • that looks like chall 3 from Flare ;) – Paweł Łukasik Sep 16 at 8:50
  • Hmnm maybe :) I am asking technical questions, not asking for clues or something – E235 Sep 16 at 20:48
0

I found that I can convert the address to one line.
This is before:
enter image description here

If I put the cursor on 68h and press in the keyboard d it add it to one line and complete it like that:
enter image description here

Another thing, the address was incorrect, it was 0044DF68 and not 680df44.
So I can just jump to this address by pressing the g key and type the address 0044DF68.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.