Question

I'm currently reversing a new application and encountered a strange behaviour: Browsing the running application with 'Cheat Engine' reveals the function names retrieved by the loaded symbols. An example address: 'xxxx.lua_getinfo+A8EE'

The applications I've reversed so far never had symbols loaded and the address looked something like this: 'XXX.exe+834AF0' (means it has no symbols loaded)

Opening this application in 'IDA Pro Advanced' doesn't reveal any symbols but only generical named functions.

Does somebody know how to extract these symbol names and their addresses into a file like .pdb?

Était-ce utile?

La solution

lua_getinfo is probably just one of the DLL's exports, and Cheat Engine uses the closest one to show you this expression. It does not mean that the address in question actually belongs to the lua_getinfo function.

Licencié sous: CC-BY-SA avec attribution
Non affilié à StackOverflow
scroll top