roxaz
October 27th, 2009, 08:01
I know this is stupid... but i cant get it working. I would like to rip out one funcion from idb, i mark it, start csc, tune options a bit, uncheck 'sudden death on first fatal', click go and it gets aborted after putting out some logs in csc report window. log in ida log widow:
CSC log window:
Seems csc is trying to dump whole idb to asm file. So how do i rip out single function then?
Code:
[csc] code snippet creator starting at 00579AE0 (SendPacketSafe)
[csc] range <00579AE0-00579B45> successfully added (func SendPacketSafe)
[csc] warning: included variable EnterCriticalSection in special segment
[csc] range <00EC8070-00EC8074> successfully added (bss: EnterCriticalSection)
[csc] warning: runtime-evaluated address detected at 00596109 (target unknown)
[csc] range <00596090-00596119> successfully added (func SendPacket)
[csc] range <0046FCB0-0046FD4B> successfully added (func sub_46FCB0)
[csc] range <008F3758-008F3760> successfully added (bss: dword_8F3758)
[csc] range <00796F85-00797270> successfully added (bss: aBadAllocation)
[csc] range <0085C5FC-0085C61C> successfully added (bss: SubKey)
[csc] warning: included variable RegOpenKeyExA in special segment
[csc] range <00EC8270-00EC8274> successfully added (bss: RegOpenKeyExA)
[csc] warning: offset to tail at 0085C61C
[csc] range <0085C61C-0085C620> successfully added (bss: ValueName)
[csc] error: unaligned reference to 00434353 was found - try to redefine
[csc] target area or revise the offset at 0085C61C
[csc] warning: included variable RegQueryValueExA in special segment
[csc] range <00EC8274-00EC8278> successfully added (bss: RegQueryValueExA)
[csc] warning: included variable RegCloseKey in special segment
[csc] range <00EC8278-00EC827C> successfully added (bss: RegCloseKey)
[csc] range <0085C620-0085C628> successfully added (bss: dword_85C620)
[csc] warning: runtime-evaluated address detected at 0046FB5F (target unknown)
[csc] warning: runtime-evaluated address detected at 0046FB8D (target unknown)
[csc] warning: runtime-evaluated address detected at 0046FBCF (target unknown)
[csc] warning: runtime-evaluated address detected at 0046FC8B (target unknown)
[csc] range <0046FB30-0046FCAA> successfully added (func sub_46FB30)
[csc] range <00CE690C-00CE691C> successfully added (bss: dword_CE690C)
[csc] range <0085C5F4-0085C5F7> successfully added (bss: Mode)
[csc] warning: included variable fopen in special segment
[csc] range <00EC8568-00EC856C> successfully added (bss: fopen)
[csc] warning: included variable fgets in special segment
[csc] range <00EC856C-00EC8570> successfully added (bss: fgets)
[csc] warning: included variable ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z in special segment
[csc] range <00EC8404-00EC8408> successfully added (bss: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z)
[csc] warning: unicode string at 0085C5F8 possible compatibility issue
[csc] range <0085C5F7-0085C5FC> successfully added (bss: asc_85C5F8)
[csc] warning: included variable ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z in special segment
[csc] range <00EC8420-00EC8424> successfully added (bss: ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z)
[csc] warning: included variable ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z in special segment
[csc] range <00EC8424-00EC8428> successfully added (bss: ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z)
[csc] warning: included variable ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB in special segment
[csc] range <00EC8428-00EC842C> successfully added (bss: ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB)
[csc] warning: included variable ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z in special segment
[csc] range <00EC842C-00EC8430> successfully added (bss: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z)
[csc] warning: included variable atoi in special segment
[csc] range <00EC84E4-00EC84E8> successfully added (bss: atoi)
[csc] warning: included variable ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ in special segment
[csc] range <00EC8408-00EC840C> successfully added (bss: ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ)
[csc] warning: included variable fclose in special segment
[csc] range <00EC8524-00EC8528> successfully added (bss: fclose)
[csc] range <00775180-0077519D> successfully added (func sub_775180)
[csc] warning: runtime-evaluated address detected at 007753C3 (target unknown)
[csc] range <00775380-007753E4> successfully added (func sub_775380)
[csc] range <008FB1D0-008FB1D1> successfully added (bss: byte_8FB1D0)
[csc] range <00775290-007752C6> successfully added (func sub_775290)
[csc] range <008FB218-008FB219> successfully added (bss: byte_8FB218)
[csc] range <008FB1D8-008FB204> successfully added (bss: dword_8FB1E0)
[csc] warning: runtime-evaluated address detected at 00775207 (target(s) known from run trace)
[csc] warning: runtime-evaluated address detected at 00775214 (target(s) known from run trace)
[csc] warning: runtime-evaluated address detected at 00775222 (target(s) known from run trace)
[csc] warning: runtime-evaluated address detected at 00775230 (target(s) known from run trace)
[csc] warning: runtime-evaluated address detected at 0077523E (target(s) known from run trace)
[csc] warning: runtime-evaluated address detected at 0077524C (target(s) known from run trace)
[csc] warning: runtime-evaluated address detected at 0077525A (target(s) known from run trace)
[csc] warning: runtime-evaluated address detected at 00775268 (target(s) known from run trace)
[csc] range <007751C0-00775274> successfully added (func sub_7751C0)
[csc] range <008DA075-008DA090> successfully added (bss: aGameshielddll_)
[csc] warning: included variable LoadLibraryA in special segment
[csc] range <00EC8030-00EC8034> successfully added (bss: LoadLibraryA)
[csc] warning: included variable GetProcAddress in special segment
[csc] range <00EC8034-00EC8038> successfully added (bss: GetProcAddress)
[csc] range <008DA061-008DA075> successfully added (bss: aFrostsetuserna)
[csc] range <008DA052-008DA061> successfully added (bss: aFrostconnect)
[csc] range <008DA046-008DA052> successfully added (bss: aFrostsend)
[csc] range <008DA039-008DA046> successfully added (bss: aFrostrecv)
[csc] range <008DA029-008DA039> successfully added (bss: aFrostwsasend)
[csc] range <008DA01C-008DA029> successfully added (bss: aFrostwsarecv)
[csc] range <008DA00E-008DA01C> successfully added (bss: aFrostsendto)
[csc] range <008DA000-008DA00E> successfully added (bss: aFrostrecvfrom)
[csc] info: ignoring hidden function unknown_libname_2 on request
[csc] info: ignoring hidden function _atexit on request
[csc] range <008FB1CC-008FB1D0> successfully added (bss: dword_8FB1CC)
[csc] warning: included variable send in special segment
[csc] range <00EC8304-00EC8308> successfully added (bss: send)
[csc] warning: included variable WSAGetLastError in special segment
[csc] range <00EC82E4-00EC82E8> successfully added (bss: WSAGetLastError)
[csc] warning: runtime-evaluated address detected at 00595FF8 (target unknown)
[csc] warning: runtime-evaluated address detected at 00596006 (target unknown)
[csc] warning: runtime-evaluated address detected at 00596045 (target unknown)
[csc] warning: runtime-evaluated address detected at 00596071 (target unknown)
[csc] range <00595FB0-00596083> successfully added (func sub_595FB0)
[csc] warning: included variable InterlockedExchange in special segment
[csc] range <00EC8080-00EC8084> successfully added (bss: InterlockedExchange)
[csc] warning: included variable shutdown in special segment
[csc] range <00EC82F8-00EC82FC> successfully added (bss: shutdown)
[csc] warning: included variable WSACloseEvent in special segment
[csc] range <00EC82FC-00EC8300> successfully added (bss: WSACloseEvent)
[csc] warning: included variable closesocket in special segment
[csc] range <00EC8300-00EC8304> successfully added (bss: closesocket)
[csc] warning: included variable WSACleanup in special segment
[csc] range <00EC82F0-00EC82F4> successfully added (bss: WSACleanup)
[csc] warning: included variable memmove in special segment
[csc] range <00EC8508-00EC850C> successfully added (bss: memmove)
[csc] warning: included variable LeaveCriticalSection in special segment
[csc] range <00EC8074-00EC8078> successfully added (bss: LeaveCriticalSection)
[csc] catastrophic: 1 integrity error(s) on code or data traversal (see report for details)
CSC log window:
Code:
00EC8070 INFO including variable EnterCriticalSection in special segment
00596109 CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
00EC8270 INFO including variable RegOpenKeyExA in special segment
0085C61C DOUBTFUL OFFSET offset to tail
00434353 CATASTROPHIC unaligned reference from 0085C61C (dd offset loc_434352+1)
00EC8274 INFO including variable RegQueryValueExA in special segment
00EC8278 INFO including variable RegCloseKey in special segment
0046FB5F CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
0046FB8D CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
0046FBCF CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
0046FC8B CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
00EC8568 INFO including variable fopen in special segment
00EC856C INFO including variable fgets in special segment
00EC8404 INFO including variable ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z in special segment
0085C5F8 COMPATIBILITY unicode string possible compatibility issue
00EC8420 INFO including variable ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z in special segment
00EC8424 INFO including variable ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z in special segment
00EC8428 INFO including variable ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB in special segment
00EC842C INFO including variable ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z in special segment
00EC84E4 INFO including variable atoi in special segment
00EC8408 INFO including variable ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ in special segment
00EC8524 INFO including variable fclose in special segment
007753C3 CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
00775207 CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
00775214 CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
00775222 CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
00775230 CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
0077523E CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
0077524C CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
0077525A CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
00775268 CODE CONTINUITY runtime-evaluated address (call insn.) - target(s) known from run trace
00EC8030 INFO including variable LoadLibraryA in special segment
00EC8034 INFO including variable GetProcAddress in special segment
007752D0 INFO ignoring hidden function unknown_libname_2
00775504 INFO ignoring hidden function _atexit
00EC8304 INFO including variable send in special segment
00EC82E4 INFO including variable WSAGetLastError in special segment
00595FF8 CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
00596006 CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
00596045 CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
00596071 CODE CONTINUITY runtime-evaluated address (call insn.) - target unknown
00EC8080 INFO including variable InterlockedExchange in special segment
00EC82F8 INFO including variable shutdown in special segment
00EC82FC INFO including variable WSACloseEvent in special segment
00EC8300 INFO including variable closesocket in special segment
00EC82F0 INFO including variable WSACleanup in special segment
00EC8508 INFO including variable memmove in special segment
00EC8074 INFO including variable LeaveCriticalSection in special segment
Seems csc is trying to dump whole idb to asm file. So how do i rip out single function then?