Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 05-27-2003, 21:14
kade
 
Posts: n/a
IDA Question about "db ? ; unexplored"

Hi,

I have a target (safedisc v2.8.11) which I am fully reversing to improve my skills. At the moment I am looking at secdrv.sys which is created from the main exe. I already found the decryption routine, but when I disassemble the main exe, the region of interest that contains the encrypted data is displayed as "db ? ; unexplored". How can I tell IDA that it needs to display those bytes? I need this because I want to write an idc script to emulate the decryption routine. Some of you might say that there are easier ways to get hold of secdrv.sys and I know, and I have done that. But for me it is only to practice my ida and reversing skills. I already fully reversed the appended section to the main app, ~e5d141.tmp, and the anti-debugging part of ~df394b.tmp. That only leaves me secdrv.sys, drvmgt.dll, ~defd6a.tmp and ~efe2.tmp. I have a long way to go, but as long as I have fun doing it ... I will do it.

Here is an illustration of my problem :

Hexviewer

EBFDA 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11
EBFEC 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11
EBFFE 11 11 00 00 00 00 13 CD 25 19 04 00 00 00 00 00 07 00

in IDA :

.data:004EBFFC db 11h ;
.data:004EBFFD db 11h ;
.data:004EBFFE db 11h ;
.data:004EBFFF db 11h ;
.data:004EC000 db ? ; unexplored
.data:004EC001 db ? ; unexplored

Kade

Last edited by kade; 05-27-2003 at 22:27.
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How come new registrants given "guest" rank and not even a "friend" rank? OldieHans General Discussion 4 09-25-2023 12:19
Wlscgen: Are "Vendor Id" and "Developer Id" different ? Numega Softice General Discussion 6 02-12-2007 18:12
"newbie" question for crackers ;) newbie007 General Discussion 4 10-07-2003 04:46


All times are GMT +8. The time now is 07:52.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )