Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: IDA Question


Veteran Member

Status: Offline
Posts: 74
Date:
IDA Question




-- Edited by ffaspector on Saturday 17th of October 2009 10:30:10 AM

__________________


Guru

Status: Offline
Posts: 963
Date:

What version of IDA are you using?

What I do is click on the data part then use Ctrl-R, set it to 32bit (3) and the Base to 0xFFFF000.

It would then show up as 0xFFFF8237 - 0xFFFF0000. I renamed 0xFFFF0000 as RAM0 so on mine it shows as 0xFFFF8237 - RAM0. You can then rename 0xFFFF8237. The only problem with this method is it just offsets the single instance. You have to search the whole flash for 8237 and then go through and Ctrl-R each instance.

I'm sure there is a better way but hell if I know what it is.

I just ordered this book that someone recommended to me.


__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:30:03 AM

__________________


Veteran Member

Status: Offline
Posts: 74
Date:

Okay, got it to work using ctrl-r and making it the low16, set the target to ffff8237, and the base to 0. PITA to do that for the whole file.


-- Edited by ffaspector on Saturday 17th of October 2009 10:29:55 AM

__________________


Veteran Member

Status: Offline
Posts: 74
Date:

This is the code I made for the shortcut, saved in user_scripts.idc:

#include <idc.idc>//Mandatory
#define REF_LOW16 4 // low 16bits of 32bit offset

// Take a 16-bit data value and make it a low16 offset towards extended 7052 space (0xFFFF0000+Data)
static MakeLowOff() {
auto ar,ad,ado;
ar=ScreenEA();
ad=Word(ar);
ado=ad+0xFFFF0000;
OpOffEx(ar,0,REF_LOW16,ado,0x0,0x0);
}


And this went in the ida.idc file:

#include <user_scripts.idc>

static main(void) {
...
AddHotkey("0","MakeLowOff");



-- Edited by ffaspector on Saturday 17th of October 2009 10:29:23 AM

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard