Hello,

the data section of my program has 0xC0000040 characteristics, when i disassembled my program in ida
it shows data section as code, i have to convert all this manually to strings, i changed the data section
characteristics to 0xE0000020, but now i want ida to reanalyze just the data section, is it possible ?
if not, will reanalyzing the whole program gonna make ida show data as data and not as code ?

best regards
The Keeper

move to tools of trade please.

Hi

Moved.
I'm a little confused, you say the data section was C0000040, which is normal for a .data section, then you changed it to E0000020, which signifies an executable .code section. Unless this was a typo, I'd say leave it at C0000040.

You can select a block of data (use the Edit function Alt-L to begin selection then scroll to end, right click and select Data to convert). To be honest your question about - will reanalyzing do such and such - kind of begs the answer, why not just try it and find out?

Kayaker

What about idc ?
AnalyseArea should do the trick.

you are not forced to make a script to use IDC statement, use calculator or "command line" (look config file)

Cheers.

Hello,

Kayaker, its a 200mb database, i'd rather ask than loose a full day disassembling the program. the section characteristics was not a type, ida recogized the data section as code, so maybe setting it as code ida would recognize as data :P

i can select all the data section and then type 'a' for example but then it will convert like :

Jan db "January",0,"February",0

not the way i want

Jan db "January",0
Feb db "February",0

well, thats ok, i already convinced myself to convert all those strings manually.
AnalyseArea converts data to code, i wanna convert code to data

I offen select a block of uncorrect data, press "U" to undefine it, then select every block of string and press "a". So I will have:
Jan db "January",0
Feb db "February",0
Sorry if my way is wrong.
Regards

Heheh, I thought the reason for you asking might be something like that

I know what you mean though, I've had to go in and manually define string data individually like TQN mentions, it would be nice though if there was a script or plugin, if one doesn't already exist, that would correctly parse a block of data into discrete strings, recognizing null terminators and ignoring non-ascii values.


Cheers,
Kayaker