2

I've been analyzing a dll file and naming the functions, structs, variables, and so on. A lot of information has been changed and saved, but after the following message appears, the address column of the Export table is not correct.

The decompiler assumes that the segment '.rdata' is read-only because of its NAME. 
All data references to the segment will be replaced by constant values. This may lead to drastic changes in the decompiler's output. 
If the segment is not read-only, please change the segment NAME. 
In general, the decompiler checks the segment permissions, class, and name to determine if it is ready-only.

The addresses in the 'Address' column don't point to the correct position and mismatch the ones in the Functions window. They all point to addresses in .data section. I have tried to delete the export table and reanalyze, but I don't know how to do it. I want to know why this happened and how to recover it.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.