Good Practice

Jump to bottom Edit New page

Wiz edited this page May 8, 2014 · 4 revisions

Relative Address Tables

IDA's IDC export function does not properly export the following structures, when they are located after address 0xFFFF :

Relative Jump Tables (RJT, labeled with prefix "rjt_")
Branch Tables (BT, labeled with prefix "bt_")
Relative Pointer Tables (RPT, labeled with prefix "rpt_")

The script generate/fixes/fixes.idc contains the needed instructions to fix all the RJTs/BTs/RPTs that are defined in the IDB.

Beware : Everytime a new RJT/BT/RPT is defined after 0xFFFF, it also has to be defined in generate/fixes/fixes.idc.