|
I solved my problem.
My problem had nothing to do with ida, but with the .data section header. Apparently safedisc sets its virtual size to 8D458 and its raw size to 1B000. This explained my problem, setting the raw size allso to 8D458 did the trick. Ida read the file like I wanted to. One lesson I learned is that ida only displays the first rawsize bytes and after that all the bytes become "db ? ; unexplored" or 0FFh if you like.
Here is the end result :
.data:004EBFFB db 11h ;
.data:004EBFFC db 11h ;
.data:004EBFFD db 11h ;
.data:004EBFFE db 11h ;
.data:004EBFFF db 11h ;
.data:004EC000 db 0 ;
.data:004EC001 db 0 ;
.data:004EC002 db 0 ;
.data:004EC003 db 0 ;
.data:004EC004 db 13h ;
.data:004EC005 db 0CDh ; -
.data:004EC006 db 25h ; %
But now I have a few related questions regarding to windows, not ida:
When do the sections get loaded into memory? Do they get loaded regarding the virtualsize or the rawsize? Does windows takes care of this or does your program has to do it itself?
I ask this because when I set a breakpoint in softice on the entrypoint, I cannot use the command dd to view data within the segments except for the segment where the entrypoint is. All softice shows is "?? ?? ?? ??".
The sections are as follows with their flags:
.text 60000020
.rdata 40000040
.data C0000040
.rsrc 40000040
stxt774 E0000020
stxt371 E0000020
stxt371 contains the entrypoint and is loaded into memory when softice pops up at "bpx entrypoint". All the other sections are not loaded into memory yet. Why does that happen? The flags do not show that the sections would not be loaded into memory.
Last edited by kade; 05-30-2003 at 01:00.
|