1

When I load most windows NE/PE executables, IDA first warns me about the file being possibly packed, then it warns me with this dialog: "The input file has extra information at the end (tail < hex >, loaded < hex >), continue?". It loads the file, but only shows the "This program cannot be run in DOS mode." DOS stub and that's it. No import/export tables, structs, etc.

How can I force IDA to recognize the PE header and load that instead of the DOS stub?

|improve this question
3

Normally it should be selected by default but...

enter image description here

|improve this answer
  • It doesn't show up as an option. Only binary file or MS-DOS executable show up. – Discord Sep 18 '14 at 0:11
  • pe.ldw also is missing from the IDA loaders directory. Is there a way to get it? – Discord Sep 18 '14 at 0:14
  • @Discord If you are on windows try IDA 5.0 in case your copy of IDA is corrupted. – 0xec Sep 18 '14 at 4:50
  • I managed to recover a copy of pe.ldw. Thanks for the help. – Discord Sep 18 '14 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.