2
Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand".
First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, ...
2
Found it in IDAPython documentation.
There is a function exec_idc_script here in module ida_expr.I never used it myself but according to the spec it should work.
In addition there is a RunPythonStatement in IDC if you need to do it conversely.
2
when you are here 4017ff: 55 push rbp
your 5th argument will be available at [rsp+28]
(8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register)
two pushes and one subtract will make your argument no 5 available at
0x28 + 0x8 +0x8 +0x48 = 0x80
so rbp+0 will hold the address of 5th ...
1
I've spent many hours (too many for me to admit) trying to figure this out and I just realized what it is, right after hitting submit. push instructions implicitly decrease the stack pointer. The call to the function DotProduct calls push three times; once in the call instruction itself, where the return address is implicitly pushed, and twice in the ...
1
I figured it out:
Right click and go to hex editor, then search the bytes you are looking for, then after finding it right click and select go to code reference.
Only top voted, non community-wiki answers of a minimum length are eligible
