| View previous topic :: View next topic |
| Author |
Message |
lampuiho
Expert Cheater
![]() Reputation: 6
Joined: 16 Jan 2010
Posts: 122
|
 Posted: Thu May 08, 2014 8:39 am Post subject: How to attach exe that rebases itself with IDA pro? |
 |
|
When it rebases itself I think ida pro has to check all references again so it's taking forever to rebase the image. How do I stop that?
I have seen something about running a dumped exe but dumping memory is easy, and rebuilding a working one is not.
The game is already cracked so I have no idea why it's still doing all these things to prevent me from attaching a debugger to it :/ |
|
| Back to top |
|
 |
lampuiho
Expert Cheater
![]() Reputation: 6
Joined: 16 Jan 2010
Posts: 122
|
| Posted: Tue May 20, 2014 5:23 am Post subject: |
|
|
don't know why no one is replying but i guess i'll provide some more information including the game i'm trying to get to work
it's FM2014.
You can see the imagebase addresses in the picture
 |
|
| Back to top |
|
|
STN
I post too much
 Reputation: 43
Joined: 09 Nov 2005
Posts: 2676
|
| Posted: Tue May 20, 2014 8:41 am Post subject: |
|
|
What do you mean by rebases itself, the imagebase is at 4000000 and when you run it it should be at that unless it specifically wants to load at different address or is not available.
Either way, IDA or any debugger should have no problem attaching to it. I haven't used IDA's debugger but i don't see why it should have a problem. I doubt IDA will scan the exe again if you run it and it changes its base, maybe it is scanning other loaded modules.
_________________
|
|
| Back to top |
|
|
lampuiho
Expert Cheater
![]() Reputation: 6
Joined: 16 Jan 2010
Posts: 122
|
| Posted: Tue May 20, 2014 12:28 pm Post subject: |
|
|
| STN wrote: | What do you mean by rebases itself, the imagebase is at 4000000 and when you run it it should be at that unless it specifically wants to load at different address or is not available.
Either way, IDA or any debugger should have no problem attaching to it. I haven't used IDA's debugger but i don't see why it should have a problem. I doubt IDA will scan the exe again if you run it and it changes its base, maybe it is scanning other loaded modules. |
see the memory region window. The base becomes dd0000. It's random each time.
It takes forever to attach when it tries to rebase the program. It gets into some kind of "close to infinite" loops when checking for reference addresses.
IDA pro is not a simple debugger. It's mainly for static analysis like structure redefining, pseudo code decompilation, etc |
|
| Back to top |
|
|
lampuiho
Expert Cheater
![]() Reputation: 6
Joined: 16 Jan 2010
Posts: 122
|
| Posted: Fri May 23, 2014 12:13 am Post subject: |
|
|
| why is no one telling me where to look for the relocation code and the relocation information in the header |
|
| Back to top |
|
|
Chris12
Expert Cheater
![]() Reputation: 1
Joined: 27 Apr 2012
Posts: 103
|
| Posted: Fri May 23, 2014 3:40 am Post subject: |
|
|
| maybe because no one knows? |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
