IDA Pro中"The database is corrupted"的解决办法
2007-11-16 13:07
411 查看
ida pro默认不允许你打开由其他用户创建的idb文件,这给逆向分析带来很多不便。
经过研究发现,ida pro会在idb文件中存放ida.key的信息,用于标示创建者。因此我们需要用自己的ida.key中的内容进行替换。
注: 替换之后,打开idb文件会提示校验失败,保存一下就好了。另外当idb以deflate方式存放的时候需要先解压缩之后再进行替换
首先打开你的idb文件,查找"$ original user",然后往前移167个字节,将之后的160个字节替换为ida.key文件中从倒数320字节开始的160个字节即可
可以用如下的WinHex脚本来自动化上面的流程
ExitIfNoFilesOpen
Turbo On
ForAllObjDo
Find "$ original user" MatchCase
IfFound
Move -7
Block2 CurrentPos
Move -160
Block1 CurrentPos
//Your key
Write 0x68A6CCA68835B991192761B9EAA2760131041C723505F3F7D052DA513878F505
Write 0x1CB84A17B46D255F29B84681C9B89F5A1FD04A23C6874380D78DE941B814EFE5
Write 0x416DC51B7F1EEE50D88EA674472CB4BF41E3CE11FCA6A69BA97DB17282944D78
Write 0xA8B5FB4BDF366637F818C2E003B4CC65952AFAAC586070C115B776B2E72CE437
Write 0x0000000000000000000000000000000000000000000000000000000000000000
Else
MessageBox "Can't find key data"
EndIf
EndDo
经过研究发现,ida pro会在idb文件中存放ida.key的信息,用于标示创建者。因此我们需要用自己的ida.key中的内容进行替换。
注: 替换之后,打开idb文件会提示校验失败,保存一下就好了。另外当idb以deflate方式存放的时候需要先解压缩之后再进行替换
首先打开你的idb文件,查找"$ original user",然后往前移167个字节,将之后的160个字节替换为ida.key文件中从倒数320字节开始的160个字节即可
可以用如下的WinHex脚本来自动化上面的流程
ExitIfNoFilesOpen
Turbo On
ForAllObjDo
Find "$ original user" MatchCase
IfFound
Move -7
Block2 CurrentPos
Move -160
Block1 CurrentPos
//Your key
Write 0x68A6CCA68835B991192761B9EAA2760131041C723505F3F7D052DA513878F505
Write 0x1CB84A17B46D255F29B84681C9B89F5A1FD04A23C6874380D78DE941B814EFE5
Write 0x416DC51B7F1EEE50D88EA674472CB4BF41E3CE11FCA6A69BA97DB17282944D78
Write 0xA8B5FB4BDF366637F818C2E003B4CC65952AFAAC586070C115B776B2E72CE437
Write 0x0000000000000000000000000000000000000000000000000000000000000000
Else
MessageBox "Can't find key data"
EndIf
EndDo
相关文章推荐
- "The requested resource (... processLogin.action) is not available"的问题所在及解决办法
- [原]在Oracle SOASUITE 10g Register ESB 报“The exception reported is: "javax.transaction.RollbackException: Timed out”问题的解决办法
- VC中The symbol is "xxx" undefined解决办法
- FCKeditor出现"this connector is disabled Please check the"editor/filemanager/connectors/aspx/config.aspx"错误的解决办法
- Ubuntu更新出现"The system is running in low-graphics mode"错误提示的解决办法
- The processing instruction target matching "[xX][mM][lL] "is not allowed错误解决办法总结
- MYSQL 执行Insert语句throws "The table 'xxx' is full" 的问题分析及解决办法
- VC中The symbol is "xxx" undefined解决办法
- asp.net中使用fckeditor时,提示“this connector is disabled Please check the"editor/filemanager/connectors/aspx/config.aspx”解决办法
- 解决"Bower : ENOGIT git is not installed or not in the PATH"问题
- ios在真机上调试时出现“Error launching remote program: failed to get the task for process xxx"解决办法(转)
- "the account is locked"的解决方法
- iOS开发--"performSelector may cause a leak because its selector is unknown"警告原因及其解决办法
- warning: the 'gets' function is dangerous and should not be used.的解决办法
- firebug 解决 "The resource from this URL is not text"
- Ubuntu技巧之"xxx is not in the sudoers file"解决方法
- "field_is_visible_in_query" error 解决办法
- Spring MVC "The request sent by the client was syntactically incorrect ()"解决办法
- 打开Eclipse时出现"Failed to create the Java Virtual Machine"解决办法
- 用sudo时提示"xxx is not in the sudoers file. This incident will be reported 的解决办法