0

I have two versions of the same binary, and I know that both are using a float (127.0) which is stored in a variable like ds:dbl_7F5A28 (offset from binary #1).

There's only one xref to that dbl_ in both binaries, but I don't know how to find 127.0 in binary #2, so I can xref it and find the function that's using it.

So, is there a way to search for float / double values in IDA?

  • I'm not sure if this helps at all, but would it be easier to search for the instructions that manipulate floating point values? – user1743 Apr 11 '15 at 16:37
  • 1
    @blahfish I'm analyzing a game, and floating point values are (ab)used a lot, so that wouldn't help – rev Apr 11 '15 at 16:39
1

There are some ways to do this.

  1. Text search. Just press Alt-T in the disassembly window and enter 127.0. This will probably not work if in your current idb version this value is not recognized as floating point number.
  2. Binary search. Go to the binary where your known value resides, go to the address of this value and undefine it/see its byte contents any other way. You will see the binary representation on the same place. Search it as a binary on the second binary and you'll probably find desirable.

Good luck

  • The problem is that the binary is kinda big (200MB+), so text search is really, really slow and not effective. Binary search didn't work (searched for 0x42fe0000 -> 127.0) – rev Apr 12 '15 at 8:31
  • what does it mean didn't work ? Gave too much alternatives or did not find anything ? Did you try binary search on first executable ? – w s Apr 12 '15 at 8:35
  • Did not find anything, however, I just found the function by xref-ing other known functions, and it does use the number (as I supposed). Therefore, not a reliable way to search for floats. – rev Apr 12 '15 at 8:36
  • 1
    Does binary representation looks the same in both executables ? – w s Apr 12 '15 at 8:37
  • It 'does': in one binary it's like 127.0, in the other one it's in hexadecimal form. I can, of course, make both be 127.0 or 0x42fe0000 by redefining the type, but if I need to find it first, there's no way I can do this. – rev Apr 12 '15 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.