![]() |
|
|
|
#1
|
|||
|
|||
|
Re
Quote:
If you are sure that you know the compiller, you may load flirt signatures for it manualy "File -> Load file -> Flirt signature file" |
|
#2
|
||||
|
||||
|
Using PEID I identified the EXE as a Visual C++ application, and loaded FLIRT signatures for Visual C++ runtime libraries. IDA then correctly identified some low-level funtions like GlobalAlloc, ReadFile and such. But no printfs, strcpy and alike. Am I missing something here? Didn't find FLIRTS for the standard libraries. Are you supposed to have the compiler in question and make your own FLIRTS? The help file included, which is the only documentation I have, seemed a bit rudimentary for me.
Grateful for any help, just recently got hold of this IDA and haven't had much time learning all the features yet. Guess I was so eager to reverse this puppy
|
|
#3
|
|||
|
|||
|
Re
Does IDA detect Visual C runtime automaticaly or not? What does it write to log?...IDA have very good Flirt signatures to VisualC.... if it does'nt recognize some runtime functions it seems that application is not maded by VisualC... May be it something similar... like MS Fortran Powerstation or IntelC...
How old your application is? If you have a bit old machine (like P-III) you may try to redetect runtime by http://protools.anticrack.de/files/utilities/fi.zip..... |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Difference dumping @ OEP or runtime ? | wildmans | General Discussion | 4 | 08-30-2005 20:51 |