1

In an application I'm analyzing, there's a global variable whose purpose/role in the program is known to me. I'd like to rename it, but for some reason I cannot.

The assembly code:

.text:00537E90                 mov     edx, ds:1C968D8h
.text:00537E96                 mov     [eax], edx
.text:00537E98                 mov     ds:1C968D8h, eax

If I position the cursor on the address (ds:1C968D8h) and try to jump (using Enter), IDA will complain Command "JumpEnter" failed. Attempting to rename it with the N hotkey will cause IDA to place a label at that address rather than rename the variable as intended.

While I'm doing this for educational purposes, this is a proprietary application, so I don't have the source code.

I've checked Chris Eagle's "The IDA Pro Book", but there seems to be nothing on the subject in there.

Help is greatly appreciated.

| improve this question | |
3

It is possible that the address segment which this data belongs to does not exists in the idb. It can happen if this segment is created dynamically by OS level memory allocation functions like VirtualAlloc or VirtualAllocEx in Windows. You can check it by viewing segment addresses in corresponding IDA window. If this segment doesn't exist, just create one from the same segment window.

If it is not so, there is another possibility: your global data is not defined as offset ( and not treated as address ). Place cursor on it, press left button, press o on the keyboard to say to IDA that it is address.

| improve this answer | |
  • The second method doesn't work so I guess it must be the first one. Could you tell me a bit more? Given the address I have in my question, what segment should I add? Currently it contains .text, .idata, .rdata, .data, .tls, .version. – user4520 Oct 6 '14 at 21:46
  • 1
    The name doesn't really matter.Check addresses in vicinity of desired address for similar situation, find start address and end address and add the segment as follows: Go to View-->OpenSubviews-->Segments, press Ins, enter any name and segment boundaries, mark it as 32 bit segment, press OK, reanalyze program via Options-->General-->Analysis--> Reanalyze program. Please note that this segment will not contain real data, but it will give you an opportunity to track access to this address. – w s Oct 7 '14 at 5:18
  • Well, it turns out that the globals are indeed in the .data segment already, but the method you've described (pressing 'O') does not work, just nothing happens. Although according to hex-rays.com/products/ida/support/freefiles/… your method should work... – user4520 Oct 8 '14 at 16:15
  • It shouldn't change anything. Would you post desired address and content of segments window ? – w s Oct 8 '14 at 16:17
  • Of course. The segments: i.imgur.com/i89BeVN.png . The address I want is for example the one I've posted in my question (ds:1C968D8h). – user4520 Oct 8 '14 at 16:19
0

One thing that I've failed to notice turned out to be crucial: this file wasn't generated by my copy of IDA, it was given to me by a friend as a helping resource. I've simply disassembled the very same exe with my IDA and the troublesome address is now correct:

enter image description here

http://i.imgur.com/AzHGbT1.png

| improve this answer | |
  • 1
    In the future, it may help to undefine the target (hotkey: U), or undefine the disassembly (U), and then re-define and rename the data (D) or code (C). – Zach Riggle Oct 17 '14 at 22:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.