0

Introduction

I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called ".mydiff", I overwrote the previous file. I made sure the exe was still working without issues, and that the PE header was valid.

The problem

I opened my .i64 file (ida database) and clicked on file->load file->reload input file. The problem is that after doing this my new section is shown as "GAP" and the info (segment type, segment permissions, etc.) are all wrong.

What I tried

Attempt #1

To make sure I didn't do a mistake I copied my exe into a new folder, opened it with IDA and waited for the auto-analysis to finish (generating a new database). I checked the segment and all the info was correct, the name was loaded correctly, the segment type, segment permissions, etc. were all loaded correctly.

The problem with this attempt is that I cannot continue using this database because that would mean I lose all the progress I made the past 2 months, all my comments, structs, local types, etc.

Attempt #2

I googled a lot (I'm not sure why but it's hard to find good info about ida) and found people mentioning that you can manually create a segment in IDA. I followed the steps, put the proper addresses, name and class.

The problem with this attempt is that the information about the segment is not complete at all. Compared to Attempt #1 (generating the db again) the segment had a lot of missing information.

Attempt #3

Clicked on option->general->analysis->reanalyze program. If I don't reload the input file before the reanalysis the new section is not shown. If I reload the input file before the reanalysis the new section is shown but all its info is wrong, exactly like in Attempt #1.

My question

What would be the proper way to make sure IDA loads this new segment correctly (or reloads the entire file) without losing any of my comments, structs, etc. I made the past few months?

Improve this question
3
  • if you're familiar with IDAPython, you can serialize your comments/types/comments/structures/etc, and then apply them into the new database with #1. also, the ida_migrator plugin "might" work, as it claims to do exactly that (i haven't used it, though). however, the byte patches might not be preserved and will likely still require you to write code to enumerate them in the old database and apply them into the new database. for clarity, though, when you suggest that the segment gets "loaded" wrong, are you just referring to your annotations not being available in the new segment?
    – Ali Rizvi-Santiago
    Commented Mar 30 at 13:16
  • Sadly I'm using the free version so IDAPython is not an option. When I say the segment gets loaded wrong I mean that the info is wrong, for example flags, type, etc. Even after setting things manually (selector, name, type, flags, registers, etc.) IDA refuses to apply byte patches to this section, saying "Has no file mapping skipping...". And googling this error leads to no answers on how to fix it other than deleting the db and starting from scratch. The best suggestion I read was to use Ghidra instead hahhaa.
    – Kyuuri
    Commented Apr 1 at 17:07
  • Thanks to this I also found a bug in IDA where if you patch the exe, apply the patches, and then modify your patch in a way that some bytes are the same as original exe, and apply patches again, IDA won't revert the bytes that are the same as the original exe because it doesn't check the bytes. Even if you reload the exe IDA will be clueless in terms of what's currently in the exe. Seems like moving to Ghidra is the best idea here.
    – Kyuuri
    Commented Apr 1 at 17:13

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.