Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #6  
Old 09-23-2014, 23:05
0xd4d 0xd4d is offline
Lo*eXeTools*rd
 
Join Date: Mar 2012
Posts: 78
Rept. Given: 12
Rept. Rcvd 309 Times in 44 Posts
Thanks Given: 2
Thanks Rcvd at 176 Times in 24 Posts
0xd4d Reputation: 300-399 0xd4d Reputation: 300-399 0xd4d Reputation: 300-399 0xd4d Reputation: 300-399
@git:

1. I just manually fix it when I enter an interesting function. Copy real end address then ALT+P.

2. Change low/high suspicious limit in options to some invalid address (eg. 0), then mark all unicode strings that haven't been fully detected and press c. Choose "analyze", choose "Yes, convert to code" and it should fix your unicode strings. You can use a regular expression and search for them:

"dd offset [^ ]+00" (dd offset loc_490021)

"dd offset [^ ]+\+" (dd offset aSomeString_7+18Bh)

Could take a couple of minutes to fix all unicode strings depending on the size of your exe.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
IDA Script Function rename for Delphi VCL (x32 - x64) Coldzer0 Community Tools 0 05-12-2018 21:51
GMP function Git General Discussion 4 06-16-2011 21:33
C++ Help (Hooking a function) Peter[Pan] General Discussion 8 08-31-2004 20:37


All times are GMT +8. The time now is 12:29.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )