Hot answers tagged

2

In IDA, you can use the Appcall feature In GDB, you can use print or call commands: https://sourceware.org/gdb/onlinedocs/gdb/Calling.html (this works only when using the actual gdb program)


2

The dashed line is added by IDA to denote code flow boundaries. For example, you can see another one after the unconditional jmp, and there should be one after each retn instruction. In graph view they correspond to the end of function graph nodes. The most probable cause for the one after call is that the called function has been detected as non-returning. ...


2

ActiveX controls (.ocx) are actually simple DLLs conforming to the COM standard. In practice, it means that it exports standard COM entry points such as: DllRegisterServer DllUnregisterServer DllCanUnloadNow DllGetClassObject The most important for us is DllGetClassObject as this is the one called by the host process to create the ActiveX control(s). ...


2

Found it in IDAPython documentation. There is a function exec_idc_script here in module ida_expr.I never used it myself but according to the spec it should work. In addition there is a RunPythonStatement in IDC if you need to do it conversely.


1

IDA does not allow conflicting names anywhere in the database(including enum members). Most likely both _MAJOR_FUNCTIONS and MAJOR_FUNCTIONS have the same set of members, so the first one wins.


1

Without scripting: Select the range: Go to start of the area, press Alt+L, go to the end Edit, Export data (or Shift+E) pick "raw bytes" and enter filename in the Outpuf File field. With scripting: idc.savefile(filename, 0, startAddress, size)


1

The point of the debugger is to show what actually is in memory and not what happens to be present in the database. That said, I imagine you can come up with some script based on visit_patched_bytes(), get_original_byte() and get_db_byte().


1

IDA’s C parser does not handle some C++ syntax like namespaces. There are two options: Rename the local type or struct to have no “wrong” symbols, you can use it in type declaration then Use “Convert to struct*” context menu command on the argument/variable. This bypasses the C parser and sets the type directly.


1

I managed to solve the issue by using the following idapython code: operand_value = get_operand_value(address, 1) for segment in Segments(): if operand_value >= segment and operand_value <= SegEnd(segment): op_hex(address, 1) op_offset(address, 1, idaapi.REF_OFF32, -1, 0, 0)


1

Red highlight usually means that the address is not valid. You need to create a segment covering the target address range for it to be shown as a label.


1

I don't know if it makes it clickable, but you can use add_cref to link a location to another code location. I typically use this if I have a call site like call eax and I know that eax always points to the same location (as in your case with vtables). That way, IDA treats the call eax connected to the target location and you get all the benefits like ...


Only top voted, non community-wiki answers of a minimum length are eligible