All Questions
9 questions with no upvoted or accepted answers
3
votes
0
answers
304
views
IDA: How to automatically resolve references to Imports in modules loaded manually?
every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
- 31
2
votes
0
answers
273
views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
And there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
- 518
2
votes
1
answer
620
views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
- 21
1
vote
0
answers
118
views
In IDA is there a way to load the PE headers after the initial loading?
This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it.
But suppose I have already worked on an IDB for a while and realize that ...
- 10.9k
1
vote
0
answers
78
views
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?
As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
- 169
1
vote
0
answers
339
views
Is there a way to generate a PE from a web assembly module?
I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
- 11
1
vote
0
answers
103
views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
- 1,267
0
votes
0
answers
60
views
How do I force IDA to reload PE Header and/or segments?
Introduction
I started analyzing an exe, added many comments, structs, byte patches, etc.
After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called "....
- 1
0
votes
0
answers
278
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 518