3

I have put alot of work into renaming and fixing lvar types to better understand the code I made a mistake when I was converting some unk_dword to array I missed that it wasn't set to db but rather dd and it overwritten lots of stuff I lost many my own stuff which I know I won't get back but I can live with that, but I can't seem to get the imports to evaluate with the proper names like they were before.

I tried Load->FLIRT signature file with Microsoft VisualC 2-10/net runtime which seems to be right, didn't do anything.

In output Window I'm getting

004DB200: Already data or code (hint: make 'unexplored')

I guess I need to make it unexplored? how would I do that? I tried Undefining the Imports with the U Key it doesn't work.

Here is some screenshots how it looks

Before looked like this
before imports
After looks like this
after imports
How it really looks like
imports declares
Here is how the bytes used to look like and how they look now (8 extra bytes)
import bytes

Improve this question

1 Answer 1

Reset to default
3

This fix doesn't save to database or is overwritten upon loading IDB database it always reverts back to messed up! (I think there is something I missed to change)

Not the right way to do it.. but I managed to solve this using IDC Scripts

Open a fresh IDA PRO let it analyze then go to File -> Produce File -> Dump Database to IDC File.

Open dumped idc file in notepad and search for the start of Imports comments such as ; Imports from GDI32.dll since thats where the first Import starts.

Now just copy+paste from the idc file all the way to the end of the function before the bracket.

Backup your messed up project.idb file because this may mess up it even more if you are not careful!.

Now go to File->IDC Command... and paste something I posted at the end of this post.

IDC Command Text box has limitations you can't paste too much so you need to split up by blocks, I advise make sure your block starts with MakeDword don't end with that.

Here was my first Imports from idc file what it generated below.
(This will only work for my application only obviously, just showing you what you need to look for.)

auto x;
#define id x
MakeArray   (0X4DA0EC,  0XF14);
ExtLinA     (0X4DB200,  0,  "; ");
ExtLinA     (0X4DB200,  1,  "; Imports from GDI32.dll");
ExtLinA     (0X4DB200,  2,  "; ");
ExtLinA     (0X4DB200,  3,  "; Section 4. (virtual address 000DB000)");
ExtLinA     (0X4DB200,  4,  "; Virtual size                  : 0000090E (   2318.)");
ExtLinA     (0X4DB200,  5,  "; Section size in file          : 00000A00 (   2560.)");
ExtLinA     (0X4DB200,  6,  "; Offset to raw data for section: 0002FC00");
ExtLinA     (0X4DB200,  7,  "; Flags C0000040: Data Readable Writable");
ExtLinA     (0X4DB200,  8,  "; Alignment     : default");
MakeDword   (x=0X4DB200);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB200,  "GetObjectA");
MakeDword   (x=0X4DB204);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB204,  "DeleteObject");
MakeByte    (0X4DB208);
MakeArray   (0X4DB208,  0X4);
ExtLinA     (0X4DB20C,  0,  "; ");
ExtLinA     (0X4DB20C,  1,  "; Imports from KERNEL32.dll");
ExtLinA     (0X4DB20C,  2,  "; ");
MakeDword   (x=0X4DB20C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB20C,  "GetModuleFileNameA");
MakeDword   (x=0X4DB210);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB210,  "WritePrivateProfileStringA");
MakeDword   (x=0X4DB214);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB214,  "GetTickCount");
MakeDword   (x=0X4DB218);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB218,  "CloseHandle");
MakeDword   (x=0X4DB21C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB21C,  "GetFileTime");
MakeDword   (x=0X4DB220);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB220,  "CreateFileA");
MakeDword   (x=0X4DB224);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB224,  "GetPrivateProfileIntA");
MakeDword   (x=0X4DB228);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB228,  "GetPrivateProfileStringA");
MakeDword   (x=0X4DB22C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB22C,  "VirtualAlloc");
MakeDword   (x=0X4DB230);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB230,  "VirtualFree");
MakeDword   (x=0X4DB234);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB234,  "TerminateProcess");
MakeDword   (x=0X4DB238);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB238,  "GetExitCodeProcess");
MakeDword   (x=0X4DB23C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB23C,  "CreateProcessA");
MakeDword   (x=0X4DB240);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB240,  "GetCommandLineA");
MakeDword   (x=0X4DB244);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB244,  "SetConsoleTitleA");
MakeDword   (x=0X4DB248);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB248,  "Sleep");
MakeDword   (x=0X4DB24C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB24C,  "SetEndOfFile");
MakeDword   (x=0X4DB250);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB250,  "SetStdHandle");
MakeDword   (x=0X4DB254);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB254,  "GetFileType");
MakeDword   (x=0X4DB258);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB258,  "ExitProcess");
MakeDword   (x=0X4DB25C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB25C,  "GetNumberOfConsoleInputEvents");
MakeDword   (x=0X4DB260);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB260,  "PeekConsoleInputA");
MakeDword   (x=0X4DB264);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB264,  "GetConsoleMode");
MakeDword   (x=0X4DB268);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB268,  "SetConsoleMode");
MakeDword   (x=0X4DB26C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB26C,  "ReadConsoleInputA");
MakeDword   (x=0X4DB270);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB270,  "SetEnvironmentVariableA");
MakeDword   (x=0X4DB274);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB274,  "CompareStringW");
MakeDword   (x=0X4DB278);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB278,  "CompareStringA");
MakeDword   (x=0X4DB27C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB27C,  "LoadLibraryA");
MakeDword   (x=0X4DB280);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB280,  "WaitForSingleObject");
MakeDword   (x=0X4DB284);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB284,  "GetStringTypeW");
MakeDword   (x=0X4DB288);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB288,  "GetStringTypeA");
MakeDword   (x=0X4DB28C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB28C,  "IsBadCodePtr");
MakeDword   (x=0X4DB290);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB290,  "IsBadWritePtr");
MakeDword   (x=0X4DB294);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB294,  "IsBadReadPtr");
MakeDword   (x=0X4DB298);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB298,  "GetOEMCP");
MakeDword   (x=0X4DB29C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB29C,  "GetACP");
MakeDword   (x=0X4DB2A0);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2A0,  "GetCPInfo");
MakeDword   (x=0X4DB2A4);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2A4,  "GetEnvironmentStringsW");
MakeDword   (x=0X4DB2A8);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2A8,  "GetTimeZoneInformation");
MakeDword   (x=0X4DB2AC);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2AC,  "GetSystemTime");
MakeDword   (x=0X4DB2B0);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2B0,  "GetLocalTime");
MakeDword   (x=0X4DB2B4);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2B4,  "__imp_RtlUnwind");
MakeDword   (x=0X4DB2B8);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2B8,  "GetLastError");
MakeDword   (x=0X4DB2BC);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2BC,  "GetEnvironmentStrings");
MakeDword   (x=0X4DB2C0);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2C0,  "FreeEnvironmentStringsW");
MakeDword   (x=0X4DB2C4);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2C4,  "GetCurrentProcess");
MakeDword   (x=0X4DB2C8);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2C8,  "HeapAlloc");
MakeDword   (x=0X4DB2CC);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2CC,  "HeapReAlloc");
MakeDword   (x=0X4DB2D0);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2D0,  "HeapFree");
MakeDword   (x=0X4DB2D4);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2D4,  "RaiseException");
MakeDword   (x=0X4DB2D8);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2D8,  "GetVersion");
MakeDword   (x=0X4DB2DC);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2DC,  "ReadFile");
MakeDword   (x=0X4DB2E0);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2E0,  "WriteFile");
MakeDword   (x=0X4DB2E4);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2E4,  "SetFilePointer");
MakeDword   (x=0X4DB2E8);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2E8,  "HeapDestroy");
MakeDword   (x=0X4DB2EC);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2EC,  "LCMapStringW");
MakeDword   (x=0X4DB2F0);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2F0,  "SetHandleCount");
MakeDword   (x=0X4DB2F4);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2F4,  "GetStdHandle");
MakeDword   (x=0X4DB2F8);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2F8,  "GetStartupInfoA");
MakeDword   (x=0X4DB2FC);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB2FC,  "MultiByteToWideChar");
MakeDword   (x=0X4DB300);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB300,  "WideCharToMultiByte");
MakeDword   (x=0X4DB304);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB304,  "LCMapStringA");
MakeDword   (x=0X4DB308);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB308,  "UnhandledExceptionFilter");
MakeDword   (x=0X4DB30C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB30C,  "FreeEnvironmentStringsA");
MakeDword   (x=0X4DB310);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB310,  "HeapCreate");
MakeDword   (x=0X4DB314);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB314,  "SetUnhandledExceptionFilter");
MakeDword   (x=0X4DB318);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB318,  "GetFileAttributesA");
MakeDword   (x=0X4DB31C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB31C,  "FlushFileBuffers");
MakeDword   (x=0X4DB320);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB320,  "GetProcAddress");
MakeDword   (x=0X4DB324);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB324,  "GetModuleHandleA");
MakeByte    (0X4DB328);
MakeArray   (0X4DB328,  0X4);
ExtLinA     (0X4DB32C,  0,  "; ");
ExtLinA     (0X4DB32C,  1,  "; Imports from USER32.dll");
ExtLinA     (0X4DB32C,  2,  "; ");
MakeDword   (x=0X4DB32C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB32C,  "MessageBoxA");
MakeDword   (x=0X4DB330);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB330,  "LoadImageA");
MakeByte    (0X4DB334);
MakeArray   (0X4DB334,  0X4);
ExtLinA     (0X4DB338,  0,  "; ");
ExtLinA     (0X4DB338,  1,  "; Imports from WSOCK32.dll");
ExtLinA     (0X4DB338,  2,  "; ");
MakeDword   (x=0X4DB338);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB338,  "__imp_ioctlsocket");
MakeDword   (x=0X4DB33C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB33C,  "__imp_inet_ntoa");
MakeDword   (x=0X4DB340);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB340,  "__imp_WSACleanup");
MakeDword   (x=0X4DB344);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB344,  "__imp_WSAStartup");
MakeDword   (x=0X4DB348);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB348,  "__imp_recvfrom");
MakeDword   (x=0X4DB34C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB34C,  "__imp_sendto");
MakeDword   (x=0X4DB350);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB350,  "__imp_recv");
MakeDword   (x=0X4DB354);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB354,  "__imp_closesocket");
MakeDword   (x=0X4DB358);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB358,  "__imp_socket");
MakeDword   (x=0X4DB35C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB35C,  "__imp_inet_addr");
MakeDword   (x=0X4DB360);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB360,  "__imp_setsockopt");
MakeDword   (x=0X4DB364);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB364,  "__imp_htons");
MakeDword   (x=0X4DB368);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB368,  "__imp_htonl");
MakeDword   (x=0X4DB36C);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB36C,  "__imp_bind");
MakeDword   (x=0X4DB370);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB370,  "__imp_gethostbyname");
MakeDword   (x=0X4DB374);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB374,  "__imp_connect");
MakeDword   (x=0X4DB378);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB378,  "__imp_send");
MakeByte    (0X4DB37C);
MakeArray   (0X4DB37C,  0X4);
ExtLinA     (0X4DB380,  0,  "; ");
ExtLinA     (0X4DB380,  1,  "; Imports from zlib.dll");
ExtLinA     (0X4DB380,  2,  "; ");
MakeDword   (x=0X4DB380);
OpOff       (x, 0,  0);
OpOff       (x, 128,    0);
MakeName    (0X4DB380,  "__imp_compress");
MakeByte    (0X4DB384);
MakeArray   (0X4DB384,  0X4);
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.