All Questions
5 questions
6
votes
1
answer
2k
views
Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?
In windows PE files (32 and 64 bit) calls to imported functions look like this in IDA PRO:
call ds:SetEvent // default setting
call [ds:SetEvent] // Target Assembler set ...
- 1,560
4
votes
5
answers
6k
views
How do you compare C source code with the corresponding binary's assembly in IDA Pro?
I'm wondering if there's a way to compare source code to the disassembled assembly in IDA Pro? (e.g. I compile hello.c in Linux then open the binary in IDA Pro in OS X, and would like to compare the ...
- 173
3
votes
1
answer
2k
views
What is the meaning of this code generated by IDA Pro?
Test platform is Linux 32 bit.
I use IDA Pro to disassembly the basename from coreutils 8.5
compiled by gcc 4.6.3
Here is a code snippet generated by IDA Pro
call ...
- 2,485
3
votes
2
answers
2k
views
Is there a tool to scan for code / functions that can account for different compilers?
I have a library DLL and a program that uses the library (statically; the DLL is separate).
My goal is to find a bunch of the functions from the library in the program, but unfortunately, it looks ...
- 185
-1
votes
2
answers
964
views
extract opcodes using radare
When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program.
Is there any or similar solution to disassemble binaries for Radare2?
