From 4328117e09febd7f518b2ac7bb0a81be4bd79c02 Mon Sep 17 00:00:00 2001 From: notaz Date: Tue, 7 Apr 2015 03:20:34 +0300 Subject: [PATCH] move notes to better place, update them --- ida/notes.txt | 9 +++++++++ run_sed.sh | 13 ------------- 2 files changed, 9 insertions(+), 13 deletions(-) create mode 100644 ida/notes.txt diff --git a/ida/notes.txt b/ida/notes.txt new file mode 100644 index 0000000..903fa68 --- /dev/null +++ b/ida/notes.txt @@ -0,0 +1,9 @@ + +manual adjust: +- (exe only) find constants in .text that are actually pointers + (adjust as needed): + [456][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F]h + _[456][0-9A-F][0-9A-F][0-9A-F][0-9A-F][0-9A-F]\+ +- get rid of function chunks where possible (they're usually tailcalls) +- search for 'dword_xx+N', make byte/word, also word->byte +- convert ds:0[eax*4] -> [eax*4+0] (h hotkey) diff --git a/run_sed.sh b/run_sed.sh index 29df071..637486a 100755 --- a/run_sed.sh +++ b/run_sed.sh @@ -26,16 +26,3 @@ s/\(\\)\tloc_/\1\tnear ptr loc_/;\ s/\> $f . $f - -# manual fixup: -# - 'end start' -> 'end' -# - 'mov edi, edi', 'lea ...' -> align -# - add 'near ptr' to some jumps -# - 'cmp [ebp+edx+0], cl' -> 'cmp [ebp+edx*1+0], cl' -# - 0FFxxh constants - masm treats a byte, ONLY sometimes prefix with 'word ptr' -# - jmp near: -# - jmp _strchr -# - search for 'dword_xx+N', make byte/word, also word->byte -# - get rid of type propagation, regenerate as 'simple' var_ -# - convert ds:0[eax*4] -> [eax*4+0] (h hotkey) -# - rm function chunks - they're funcs reached by tailcalls (usually) -- 2.39.2