Jump to content
View in the app

A better way to browse. Learn more.

Tuts 4 You

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Featured Replies

Posted

I have 2 questions:

1. Is anybody familiar with a way to zoom in and out in IDA Pro Graph View without a scroll wheel? I use a special mouse which does not have one. The only ways I've found is hit "w" to zoom WAY OUT and 1 to zoom WAY IN. However, I lost the gradual zoom capability with this mouse :(.

2. What are some ways to handle locating the below function calls in code? When I xref these API calls, I'm brought to a series of jmps and the API calls themselves never actually appear in the code. Interestingly, I also cannot find references to the memory addresses of the jmps themselves in code either, so the code must use some offsets to access these jumps. Effectively, I cannot see where these functions are called at. Are there any tips for getting past this? Also note a similar situation where the graph view is full of "orphaned" jumps. Thanks.

 

6_function_jumps.png

7_idata_section.png

NOTPARTOF_FILE.png

Zooming - as far as I know, there is no keyboard shortcut for it. AutoHotKey or similar macro program should be able to emulate mouse wheel.

XRefs - if IDA can't find it, it's either unused, or accessed indirectly (eg. via code virtualized by Themida, or something similar). I'd load program in debugger, put breakpoints on these APIs and see if any breakpoint triggers. Then trace back to original program code.

  • Author

Ok thanks for that. On that note, do you know of any tips for simply just getting a program running after its headers are obstructed? I actually did a manual unpack on this one, which was packed with ASPack and I was able to successfully repair the IAT, however, I still can't load it up because it's corrupted somehow.

I saw your other question. :) 

Short answer is - you obviously didn't unpack it correctly.
Longer answer - find out what exactly is wrong and fix it. My personal favorite tool for such cases is HIEW (www.hiew.ru) - it has a great PE Verify plugin which helps a lot. Unfortunately demo version of HIEW doesn't have plugin support, so you'll have to find pirated version somewhere..

Create an account or sign in to comment

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.