0

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but debugger exits before reaching them.

Debugger: process has exited (exit code 0)

I´m not sure which options should I give a try. Some of these indirect calls got commented (;--> grey color name --> blue color) after loading IAT dinamically via running the function in charge of this operation (fortunately I can reach this function while debugging) and renaming but I neither be able to get the comments from the call instructions using idc.get_cmd or idc.get_cmd_ex

enter image description here

Looking for hearing your knowledge. Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.