Results 1 to 7 of 7

Thread: ida misinterpreted data section as code

  1. #1
    The Keeper
    Guest

    ida misinterpreted data section as code

    Hello,

    the data section of my program has 0xC0000040 characteristics, when i disassembled my program in ida
    it shows data section as code, i have to convert all this manually to strings, i changed the data section
    characteristics to 0xE0000020, but now i want ida to reanalyze just the data section, is it possible ?
    if not, will reanalyzing the whole program gonna make ida show data as data and not as code ?

    best regards
    The Keeper
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    The Keeper
    Guest

    move

    move to tools of trade please.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,146
    Blog Entries
    5
    Hi

    Moved.
    I'm a little confused, you say the data section was C0000040, which is normal for a .data section, then you changed it to E0000020, which signifies an executable .code section. Unless this was a typo, I'd say leave it at C0000040.

    You can select a block of data (use the Edit function Alt-L to begin selection then scroll to end, right click and select Data to convert). To be honest your question about - will reanalyzing do such and such - kind of begs the answer, why not just try it and find out?

    Kayaker

  4. #4
    Registered User
    Join Date
    Oct 2002
    Location
    UK
    Posts
    83
    Quote Originally Posted by The Keeper
    Hello,

    the data section of my program has 0xC0000040 characteristics, when i disassembled my program in ida
    it shows data section as code, i have to convert all this manually to strings, i changed the data section
    characteristics to 0xE0000020, but now i want ida to reanalyze just the data section, is it possible ?
    if not, will reanalyzing the whole program gonna make ida show data as data and not as code ?

    best regards
    The Keeper
    What about idc ?
    AnalyseArea should do the trick.

    you are not forced to make a script to use IDC statement, use calculator or "command line" (look config file)

    Cheers.

  5. #5
    The Keeper
    Guest
    Hello,

    Kayaker, its a 200mb database, i'd rather ask than loose a full day disassembling the program. the section characteristics was not a type, ida recogized the data section as code, so maybe setting it as code ida would recognize as data :P

    i can select all the data section and then type 'a' for example but then it will convert like :

    Jan db "January",0,"February",0

    not the way i want

    Jan db "January",0
    Feb db "February",0

    well, thats ok, i already convinced myself to convert all those strings manually.
    AnalyseArea converts data to code, i wanna convert code to data
    Last edited by The Keeper; May 14th, 2004 at 21:31.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  6. #6
    I offen select a block of uncorrect data, press "U" to undefine it, then select every block of string and press "a". So I will have:
    Jan db "January",0
    Feb db "February",0
    Sorry if my way is wrong.
    Regards

  7. #7
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,146
    Blog Entries
    5
    Quote Originally Posted by The Keeper
    Kayaker, its a 200mb database, i'd rather ask than loose a full day disassembling the program
    Heheh, I thought the reason for you asking might be something like that

    I know what you mean though, I've had to go in and manually define string data individually like TQN mentions, it would be nice though if there was a script or plugin, if one doesn't already exist, that would correctly parse a block of data into discrete strings, recognizing null terminators and ignoring non-ascii values.

    Code:
    For example, this block of data as a whole
    
    db  4Fh ; O
    db  6Eh ; n
    db  65h ; e
    db    0 ;  
    db    0 ;  
    db  90h ; 
    db  54h ; T
    db  77h ; w
    db  6Fh ; o
    db    0 ;  
    db    0 ;  
    db  90h ; 
    
    would correctly parse to
    
    aOne  db 'One',0
    db  0
    db  90h ; 
    aTwo  db 'Two',0
    db  0
    db  90h ; 
    
    without having to define 'One' and 'Two' individually
    Cheers,
    Kayaker

Similar Threads

  1. using filestreams to store data..or code as data?
    By BanMe in forum The Newbie Forum
    Replies: 7
    Last Post: August 8th, 2009, 21:58
  2. make olly treat stuff in data section as data
    By gtype in forum OllyDbg Support Forums
    Replies: 0
    Last Post: March 4th, 2009, 15:29
  3. set protected section code to writable
    By qantumsr16t in forum The Newbie Forum
    Replies: 4
    Last Post: May 6th, 2005, 07:51
  4. How to force data into a specific PE section?
    By Clandestiny in forum Advanced Reversing and Programming
    Replies: 6
    Last Post: April 8th, 2005, 09:32
  5. From code to data???
    By homunculus in forum OllyDbg Support Forums
    Replies: 6
    Last Post: February 5th, 2003, 00:56

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •