Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 11-24-2016, 21:43
jonwil jonwil is offline
VIP
 
Join Date: Feb 2004
Posts: 399
Rept. Given: 2
Rept. Rcvd 21 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 67 Times in 35 Posts
jonwil Reputation: 21
I updated it so you dont need to set CodeSize= in the ini file if its the same as Size= (less typing and less chance to accidentally screw up)
I also added support for jump tables (where you have a table at the end of the function with a list of addresses pointing to somewhere in the function). It will support the case of functions with multiple jump tables.

To use the new JumpTable stuff, you need to define a
[JumpTableSymbols] section that defines all the jump tables you want to copy.
Each symbol under there needs an Address= line (for the start of the jump table) and a Size= line (for the size in bytes of the jump table)

You also need to make sure the Size= line for the function that contains the jump table points to the end of the jump table and the CodeSize= line for that function points to the end of the code.

You also need a [JumpTargetSymbols] section.
Each symbol under that just gets an address representing a label that is the target of an entry in the jump table.

See test.ini for examples of this.


This doesn't yet support indirect jump tables (where you have both a table of addresses then another table with indexes into the first table)
Reply With Quote
The Following 2 Users Say Thank You to jonwil For This Useful Post:
mr.exodia (11-26-2016), TechLord (11-26-2016)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
unlinker IDA - an IDA plugin for extracting functions from a PE file for later reuse jonwil Community Tools 9 02-26-2022 04:48
Extracting file from MSI package new_profile General Discussion 20 12-09-2013 15:06


All times are GMT +8. The time now is 20:41.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )