0

Initially I have in IDA value in hex:

0003EF9B  A1 DC F3 12 00

But the I looked in hex editor same offset and its different:

A1-DC-F3-06-00

But it is half problem.

In hex editor I trying change the values:

0003EF9B  A1 DC F3 12 00

to:

B8 80 02 00 00

(i.e. I need load to eax value 0x280)

After editing in hex editor, I opened corrected file in IDA, and have difference:

0003EF9B  B8 DC F3 12 00

Where 0003EF9B its address in IDA.

I.e. same values (same address) is different in hex editor and IDA.

Its ms dos code and uses dos4gw. Program run under dosbox.

Why there is difference?

UPDATED

1)BEFORE changes

Before I made changes in hex editor: https://i.ibb.co/gjRxW9g/hex1.jpg

Before I made changes in IDA (disassembled view): https://i.ibb.co/qxVhZrN/ida11.jpg

Before I made changes in IDA (hex view): https://i.ibb.co/Qp0qc8M/ida12.jpg

2)AFTER changes

After I made changes in hex editor: https://i.ibb.co/NVCd34M/hex2.jpg

After I made changes in IDA (disassembled view): https://i.ibb.co/TYytDjL/ida21.jpg

After I made changes in IDA (hex view): https://i.ibb.co/zJ1fcNK/ida22.jpg

Improve this question
9
  • 1
    You are probably looking at different addresses............. have you considered the section alignment versus page alignment differences into account ..... Have you checked if all prior and post bytes match apart from these 5 bytes...... .......if the address is correct in both. And relocations are accounted for then the bytes MUST be same
    – blabb
    Commented Oct 17 at 10:52
  • 1
    Which version of IDA do you use? If you want to modify a binary you can do that directly in IDA, no need to use an external hex editor.
    – Robert
    Commented Oct 18 at 7:39
  • 1
    In the hexeditor 1st screen shot address is 3xxxxx and in after change address is 5ddxxx. So you mean to say both are same
    – blabb
    Commented Oct 18 at 17:54
  • 1
    Do you work with LE executable (for exampe, DOS4GW extender used this format). If so, the bytes could be changed by IDA (and dos4gw when it loads application) according to fixup table. More info in documention for LE format, like here: edm2.com/index.php/…
    – Max
    Commented Oct 19 at 7:43
  • 1
    I think, you should edit Fixups Record Table. For you task you probably should remove one entry from it. As for you second IDA screenshots - did you created new IDA database after editing file in hex-editor? As long as I know IDA will not automatically reflect changes - it creates database and later works only with it, you can even delete source EXE file - no problem for IDA.
    – Max
    Commented Oct 20 at 11:52

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.