• Member for 1 year, 1 month
  • Last seen this week
  • Mars
Double jump when calling functions
4 votes

It because of the "Link Incrementally". For example, there is a test program: #include <iostream> void test(void) { std::cout << "Hello" << std::endl; ...

View answer
Import Address Table in Process Hollowing
1 votes

Obviously you should resolve the address in IAT. This is a manually mapped dll code, you can take a look. #include <stdio.h> #include <Windows.h> #include <intrin.h> typedef HMODULE(...

View answer
How to change a large section of bytes to words in IDA Pro
0 votes

According to devttys0's answer. This script is for IDA version higher than 7.4. def convert_data(): align_size = ida_kernwin.ask_long(4, "align size") if align_size == None:...

View answer