1

I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and .data). This confuses IDA and causes functions to be randomly cut off, confusing the decompiler and causing various other issues. I have tried the method from this answer, but it seems to work only through the UI, idapython refuses to merge. It also takes a long time even for one merge. I tried a variant, where I, starting with the second segment, go through the segments, deleting the current segment and resizing the previous, but while small tests seemed promising, my database was messed up after several hours of running.

How can I merge these segments into one big segment?

Note: By "contiguous" I mean that every segment after the first has a start address equal to the previous segment's end address. Also, I do not care if comments and such are lost in the merging.

1

It is strange that segments ends in the middle of a function.

You could optimize your method, writing script that calculates the desired start and end of combined segments , deleting the relevant segments and then recreating as a combined segment. It is probably better than merging. You have a lot of control over parameters of the segments and it needs to be done correctly. I might be able to share code(not sure).

Anyway, if the IDB was messed up , you did something wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.