1

I'm debugging a process inside a VM via Olly, and occasionally exporting a section dump when needed and loading it on the host system for better analysis.

Right now I'm looking at a dump of a certain code section that's referencing function calls in another, dynamically allocated, section. In the debugger I can of course see all the function calls, but in IDA all I have are calls to immediate addresses that don't exist.

I'd like to be able to dump the referenced section and somehow bluntly attach it to the same .idb so IDA would be able to resolve the references for me.

I couldn't find anything about it on google or when digging around the menus. Did I miss something or is this impossible or requires an addon? It's also possible for me to write an idapython script that defines and copies the section over, but I don't see any relevant API calls.

Debugging via IDA and taking a full memory snapshot is a solution I'd like to not have to use; I enjoy using olly.

5

After loading the main dump into IDA, in IDA's menubar go to FileLoad fileAdditional binary file..., select the dump of the dynamically allocated memory, and specify the dynamic allocation address as the Loading segment.

  • Is there also a way to cut a binary out if I loaded it in the wrong offset? :) – Sleeptime Jul 16 '14 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.