2

My situation:

I analyze some piece of code and I have the following line:

         ...
         call eax
         ...

I am using IDA PRO. My problem is that I can not go to the place where eax points. I mean: normally, I have something like

        ...
        call sub_xxxxxx
        ...

and when I click on sub_xxxxxx, then IDA PRO shows me the code at sub_xxxxxx. Sometimes, there is also an offset. But now, I have that register, and when I click on that then IDA PRO is not going to that location. It opens a window where I can rename the register. I guess, IDA does not know where to go or something like that.

I also try to open it with ollydbg, but since the file is a .bin file, I could not open it(in the search window, before opening, the .bin file was not listed)

How can I handle that problem ?

  • To address the Olly issue, you could just rename the bin file to .exe so Olly sees it. – gandolf Dec 22 '14 at 6:36
6

You would need to statically determine what the value(s) of eax could be by statically reverse engineering the surrounding code, or (if you can run the target in a debugger) set a breakpoint on that call eax instruction and see what value of eax is used at runtime.

Note that for the dynamic approach, different runtime scenarios may cause eax to hold different values at that instruction address at runtime.

  • ok, thx. Is there a way to open the .bin file using ollydbg? – user3097712 Dec 21 '14 at 22:53
  • If the .bin file is actually a PE EXE or PE DLL, then yes. Just manually specify the full file path of the file in OllyDbg's open-file dialog box. Or drag-and-drop the file into OllyDbg's MDI client window. – Jason Geffner Dec 21 '14 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.