The dashed line is added by IDA to denote code flow boundaries. For example, you can see another one after the unconditional jmp, and there should be one after each retn instruction. In graph view they correspond to the end of function graph nodes.
The most probable cause for the one after call is that the called function has been detected as non-returning.
ActiveX controls (.ocx) are actually simple DLLs conforming to the COM standard. In practice, it means that it exports standard COM entry points such as:
The most important for us is DllGetClassObject as this is the one called by the host process to create the ActiveX control(s).
Found it in IDAPython documentation.
There is a function exec_idc_script here in module ida_expr.I never used it myself but according to the spec it should work.
In addition there is a RunPythonStatement in IDC if you need to do it conversely.
Select the range:
Go to start of the area, press Alt+L, go to the end
Edit, Export data (or Shift+E)
pick "raw bytes" and enter filename in the Outpuf File field.
idc.savefile(filename, 0, startAddress, size)
The point of the debugger is to show what actually is in memory and not what happens to be present in the database. That said, I imagine you can come up with some script based on visit_patched_bytes(), get_original_byte() and get_db_byte().
IDA’s C parser does not handle some C++ syntax like namespaces. There are two options:
Rename the local type or struct to have no “wrong” symbols, you can use it in type declaration then
Use “Convert to struct*” context menu command on the argument/variable. This bypasses the C parser and sets the type directly.
I managed to solve the issue by using the following idapython code:
operand_value = get_operand_value(address, 1)
for segment in Segments():
if operand_value >= segment and operand_value <= SegEnd(segment):
op_offset(address, 1, idaapi.REF_OFF32, -1, 0, 0)
I don't know if it makes it clickable, but you can use add_cref to link a location to another code location.
I typically use this if I have a call site like call eax and I know that eax always points to the same location (as in your case with vtables).
That way, IDA treats the call eax connected to the target location and you get all the benefits like ...