1
During debugging IDA does a limited amount of autoanalysis to speed up the debugging experience and not interfere with the process. What you can do is to copy the module to be analyzed to the database, then stop the debugger and let IDA finish the autoanalysis on the saved data. This can be done via the "Analyze module" command in the Modules list.
...
1
You can parse a header using File > Load file > C header file or create a type library beforehand.
1
If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.
1
Something like:
struct partially_known {
char gap0[12];
int student_id;
char gap10[32];
};
1
No, IDA does not keep a separate list of addresses handled by the user.
Normally the message you quote should mention the address of the problem so you can double-click it to jump there and fix the issue (e.g. convert data to code). If there are many such places, you can also try a mass selection and force everything in a range to code (though this may ...
1
It is strange that segments ends in the middle of a function.
You could optimize your method, writing script that calculates the desired start and end of combined segments , deleting the relevant segments and then recreating as a combined segment. It is probably better than merging. You have a lot of control over parameters of the segments and it needs to ...
1
ok I was wondering how one could include printf() intact but run without console
it seems if one uses WinMain() and compile with /subsystem:windows one can achieve this
here is a sample code
#include <stdio.h>
#include <windows.h>
int pringlob = 0;
int a = 9;
int b = 10;
int c = 33;
int WINAPI WinMain(_In_ HINSTANCE,_In_opt_ HINSTANCE,_In_ LPSTR, ...
1
The approach you outlined seems plausible; I'd probably do something similar to that if I were approaching this problem. If printf is being called via function pointer -- say, it's an import from another .DLL -- you could simply overwrite its IAT entry with the one in your DLL. Otherwise, I'd go with hooking printf directly, and passing the arguments onto ...
1
Though Igor kindly answered my immediate question, I was still left with the problem of how to conveniently dispose of these unused fixups. Fortunately I already use my own MakeUnknown and PatchBytes function, so I was able to simply include removal of fixup information with those and forget about the entire problem.
I am including this code as an example ...
1
If you want to use x64dbg for debugging and at the same time IDA Pro for static analysis, I recommend you one of my favourite plugin: https://github.com/bootleg/ret-sync
You can for example run your binary program in a VM with x64dbg and synchronize it to highlight the current instruction in IDA Pro and much more like auto rebase, controlling/BP from IDA, ...
1
Calls on x86/x64 are encoded based on how far the target is from the source, not as an RVA into the image. I.e., the number 0x1C88 is a distance, not an RVA. To find the RVA, follow the call to its destination, and then subtract that address by the module imagebase. Then, in IDA, press G and enter 0x140000000+[RVA HERE].
1
Sounds like you want ida_kernwin.ask_file, as in:
self.filename=ida_kernwin.ask_file(1, "*.xml", "Enter name of export xml file:")
Only top voted, non community-wiki answers of a minimum length are eligible
