1

I have reversed a number of functions and added definitions for some structs in an Intel x64 PE executable. A program got an update. I moved old executable with the old database into another folder and I opened new executable and IDA created new database.

Now I'd like to move information I gathered in the old executable into the new database: function names, comments for specific assembly lines, defined structures, renamed offsets(in the assembly instruction ) to represent offets of structs, etc.

I googled it and found BinDiff plugin for IDA, and successfully ported function names and comments to the same executable(in a small VC++ test solution) opened in another folder with debugging symbols stripped.

But it didn't touch the defined structures. The reason I used a small test project is because when I tried it on a real IDB, it was taking IDA too long to BinDiff the databases: the IDBs are 1.4GB in size with 180k functions recognized by IDA. I left it for half an hour and then decided to try it on a small project.

So how to move all relevant information to the new database for the new version of the executable?

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.