How do I find where a string is referenced in Ida?
Could the strings be referenced by some obtuse run-time calculation of address (to obfuscate references) rather than just straightforward absolute/relative reference (which IDA mostly could work out?) Many thanks. It could just be an array of strings that is referenced by a table of offsets into the array.
How do I change a string correctly in IDA Pro?
The last two bytes (01 00)would tell the system to move value from the string into the register, in this case, the register is R0. I have some concerns about the MOV instruction and the first four HEX bytes (4A F2 A6 50)
Why does the program counter stay the same in IDA Pro?
The compiler doesn’t produce code that says “the string is at address 0x123456”, it produces “the string is 0x1234 bytes behind this instruction”. Thus, when the program is moved in memory, the “0x1234” stays the same. Which is why your 2nd instruction adds the program counter to the relative address in R0.
How to open the string window in Ida?
This command opens the string window. The string window contains all strings in the program. However, if a range of addresses was selected before opening the window, only the selected range will be examined for strings. You can setup the list parameters by right-clicking (or pressing Ctrl-U in the text version) on the list.
How do I create a string in Ida?
If checked, IDA will display only strings explicitly marked as string items (using the create string literal command). In this case, the other checkboxes are ignored. If checked, IDA will ignore instruction/data definitions and will try to treat them as strings.
Are there only 7 bit strings in Ida?
If checked, only strings containing exclusively 7-bit characters (8th bit must be zero) will be added to the list. Please note that the user can specify which characters are accepted in the strings by modifying the StrlitChars parameter in the ida.cfg file. This setting is ignored if ‘only defined strings’ is on.
What can IDA Pro do as a disassembler?
IDA Pro as a disassembler is capable of creating maps of their execution to show the binary instructions that are actually executed by the processor in a symbolic representation (assembly language).
Are there any resources for reverse engineering 16 bit applications?
While offering some advice, I got a little caught up in the research I was doing, so here’s a list of the resources I found for picking apart 16-bit x86 applications.