Aimless
November 2nd, 2001, 10:29
Just for your information, thought I should share this knowledge with you, though I am sure MANY would have already thought of it...
IDA 4.xx version starts giving you the parameters for your disassembly. A very helpful feature this. But what happens to users who are using 4.04, or worse, 3.80 ??
More over, I know the parameters (like hwnd, lpCmdLine) etc. But I do not know the VALUES that these contains...decoded like MB_OK|MB_EXCLAMANTION and so on...
Would it not be great to have that in IDA? And in versions as old as 3.80 ???
Well, here I have found out a way. Humble and simple, but workable...
* Download ollydbg. (yup!)
* Open your program through it and it will AUTOMATICALLY show you the parameters of around 1500 APIs (with facility to add your own!)
* Run the program
* Select all and save the disassembly to file (warning, it can be QUITE big)
* Use ultraedit and strip off everything, except the addresses and the comments (parameters, with values!!)
* Create idc script which says MakeComm(address,"comment"
* Load your proggy in IDA
* F2, apply the IDC..
VOILA !!! INstant param recognitions, with character graphichs AND values of parameters.
Enjoy.
...Have Phun (Maybe I should write an essay for the uninitiated ??)
IDA 4.xx version starts giving you the parameters for your disassembly. A very helpful feature this. But what happens to users who are using 4.04, or worse, 3.80 ??
More over, I know the parameters (like hwnd, lpCmdLine) etc. But I do not know the VALUES that these contains...decoded like MB_OK|MB_EXCLAMANTION and so on...
Would it not be great to have that in IDA? And in versions as old as 3.80 ???
Well, here I have found out a way. Humble and simple, but workable...
* Download ollydbg. (yup!)
* Open your program through it and it will AUTOMATICALLY show you the parameters of around 1500 APIs (with facility to add your own!)
* Run the program
* Select all and save the disassembly to file (warning, it can be QUITE big)
* Use ultraedit and strip off everything, except the addresses and the comments (parameters, with values!!)
* Create idc script which says MakeComm(address,"comment"

* Load your proggy in IDA
* F2, apply the IDC..
VOILA !!! INstant param recognitions, with character graphichs AND values of parameters.
Enjoy.
...Have Phun (Maybe I should write an essay for the uninitiated ??)