Pisto
January 5th, 2009, 08:23 AM
hello. I loaded in IDA a not packed executable, then ran it: then, I started it with ollydbg and the memory segments have different address and length (right at start, so I guess they aren't moved). Even worse, the data and code in these segments is not shifted of the same value of the base address difference. How and why can this happen? How can I tell IDA to move the segments to match the runtime addresses?
here are some examples:
.text
OllyDbg: base=401000, length=228000
IDA: base=401000, length=226800
this_cod
OllyDbg: base=629000, length=C000
IDA: base=628000, length=BA00
functions in .text section seem shifted by 0x1F2B00 (!)
here are some examples:
.text
OllyDbg: base=401000, length=228000
IDA: base=401000, length=226800
this_cod
OllyDbg: base=629000, length=C000
IDA: base=628000, length=BA00
functions in .text section seem shifted by 0x1F2B00 (!)