There is function:

push    65h
push    edi
call    sub_5D8750

In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with zeros. I put breakpoint, this function is called before the WinMain, and immediately at the beginning of the WinMain. What kind of function could it be if IDA didn't recognize it? Maybe ZeroMemory? But why IDA not recognize it? Thanks in advance.

  • 1
    Evidently looking at the three lines the actual functionality must be in sub_5D8750. And if you know it's effectively a zero-filling then simply rename it. The reason why IDA may not have recognized it is probably because no signature matched. But that's where the I in IDA comes into play ...
    – 0xC0000022L
    Apr 19 at 14:27
  • 1
    That's 0x65 = 101 bytes. Possibly a 100 byte string with spare byte for the termination null. I already have issues with the present level of FLIRT in IDA mis-detecting functions as library functions, but it's worth it for all the times it gets the really complex ones right. You really wouldn't want it to be any more aggressive. Apr 25 at 6:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.