All Questions
2,164 questions
0
votes
1
answer
61
views
+50
How can I compare different execution traces of the same exe, but ran with different parameters?
Context
I'm working on analyzing how a software's behavior changes when run with different parameters.
My goal is to compare the execution traces (e.g., function calls, memory accesses, or instruction ...
- 35
0
votes
0
answers
29
views
Reverse Engineering S/EX RE-MAN BOARD INTERFACE SR2 SL (MRD-45-2276)
S/EX RE-MAN BOARD INTERFACE SR2 SL (MRD-45-2276)
How can I access the raw data sent by the sensors to this board?
I also need the data sheet and schematic information of the board.
- 1
1
vote
2
answers
137
views
Functions in Ida are divided into many local functions, how to remove unnecessary transitions?
I am solving the crackme And so you need to get the key, but I am doing reverse engineering for the first time and therefore I do not know how to do it, the functions in the crackme are divided into ...
- 13
0
votes
0
answers
31
views
setup Ida/x64dbg
I have a 64-bit app disassembled with Ida 9.0.
I would like to attach x64dbg to it as a plugging so that it is recognized as a debugger in Ida.
Apparently, copying the plugging (x64dbgida.py) is not ...
0
votes
0
answers
51
views
Why does a function with 3 parameters is decompiled as 9 parameters?
For a PowerPC binary with debugging symbols, the function signature is:
CrossProduct(VECTOR *,VECTOR,VECTOR)
It's correct as it matches the source code for an older version of the application:
void ...
- 249
0
votes
0
answers
22
views
Why does IDA changes functions signatures at some point?
On a PowerPC binary with symbols, when you first open it, the symbols are fine.
For instance: SetLineF2(LINE_F2 *)
But at some point, after adding a few structs, it renames all the methods like so:
...
- 249
0
votes
0
answers
54
views
IDA and hex editor different values
Initially I have in IDA value in hex:
0003EF9B A1 DC F3 12 00
But the I looked in hex editor same offset and its different:
A1-DC-F3-06-00
But it is half problem.
In hex editor I trying change the ...
- 363
0
votes
0
answers
24
views
Find out function address in the disassembled binary using MDMP
I have a log file from the target Linux machine stating where crash has occured:
0x00000000046195d3 MyApp!UnknownFunction(0x44195d3)
I have fully analyzed and disassembled in IDA MyApp binary
I also ...
- 141
0
votes
0
answers
26
views
How to create ram and rom section IDA?
I have a binary linker descriptor for preloader.bin
ENTRY(_start)
romBase = 0x00201000;
bss1Base = 0x00102000;
bss2Base = 0x00267000;
stackBase = 0x00200000;
/* log_sram_buf + bss1 should be less ...
- 101
1
vote
0
answers
43
views
directX mapping for IDA
I'm reversing a DOS application and I see in the code and in the data section some numbers that translate to DirectX Keyboard Scan-codes (standard US keyboard layout) HERE
how can I make IDA to treat ...
- 159
0
votes
0
answers
38
views
Automatically rename known functions from libraries in IDA
I have a binary file written in c and c++ which uses some libraries. The C/C++ source code of these libraries is publicly accessible online (github). Is there a way in IDA to somehow import this ...
0
votes
0
answers
31
views
Patching default.xex for Xbox 360 games with IDA or Ghidra
I'm trying to patch the Perfect Dark Zero XEX to remove the 30 FPS cap with IDA but it gets "826CFB77: has no file mapping (original: 02 patched: 01)...skipping...". Can someone help me ...
- 11
0
votes
0
answers
34
views
Restoring hashed filenames from Juiced (2005) DATs
Where is the memory address for the hash function from Juiced PC executable to restore hashed filenames?
- 11
1
vote
1
answer
57
views
How to modify a structure field in IDA to reflect the correct union member in decompiled code?
I'm reversing a Windows driver and using IDA to decompile some of its code. I've encountered an issue where the decompiler is using the wrong structure member in the decompiled output. Specifically, ...
- 21
0
votes
0
answers
27
views
Ida Pro shifted pointers not working
According to this article there is feature shifted pointers
I have pointer that points very far
*(_DWORD *)(myPointer + 0x10A33C)
*(_DWORD *)(myPointer + 0x10A340)
*(_DWORD *)(myPointer + 0x10A344)
...
- 101
0
votes
2
answers
121
views
Minecraft EXE client
im quite new in this theme and im looking for a way how to extract .jar file from exe file ( upd. its graalvm native image ). If i open this exe as archive (7zip) i can see only .rdata and others ( ...
- 1
1
vote
0
answers
52
views
How to get rid of this "Additional Parent Function" visual block in IDA
I'm using IDA (free) 8.4. Each time I open a function (Windows x64) I get a possibly huge block of "Additional Parent Function" list on the right.
It's useless to me and I'd like to know if ...
0
votes
0
answers
51
views
W32dasm vs iDA pro- What im missing "string references"
I am a total beginner doing RE and have been learning a lot thanks to this community, and I want to thank you. I already looked for something similar in the other questions, but I don't know if it is ...
0
votes
0
answers
48
views
Datamining Unity based game with Frida/IdaPro
2 years ago i was able to pull config files in terms of datamining from Android unity based game.
I was using tools like il2cpp dumper, idaPro and Frida to make this.
After some time, i wanted to make ...
- 1
1
vote
2
answers
111
views
IDAPython: Getting all arguments passed to function
I am working on getting two specific arguments from a function that is called around 1000 times in an executable. Is there any way of looping through all XREFs that reference the function and print ...
- 13
2
votes
1
answer
142
views
C disassembly - bitwise operations with 0x7FFFFFFFFFFFFFFF and 0x8000000000000000
I am using IDA to reverse engineer x86_64 binary file written in C. And pretty often I meet the following in IDA's pseudocode:
(int64)v7 | 0x8000000000000000LL
(int64)v7 & 0x7FFFFFFFFFFFFFFFLL
...
0
votes
1
answer
82
views
IDA show decimal values instead of hex and vertical alignment for ELF file
New to de-compiling, want to set up Ida to give best reading experience with ELF files from android phone.
I run in following issues:
Even though i set Edit > PlugIns > Hex-Rays Decompiler > ...
2
votes
1
answer
43
views
IDA Remote Debugging and automatically interaction with the process
I am learning IDA and currently working with the debugger. In particular, I want to automate the interaction with my remote binary (from Windows Subsystem Linux - Ubuntu 22.04 instance), like what I ...
0
votes
0
answers
47
views
How to get which Tedit is referenced when retrieving text
Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv
Now, the two parameters for the function are:
LEA param_2=>local_8,[EBP + -0x4]
MOV param_1,...
- 1
0
votes
2
answers
91
views
Finding the address of a function in an exe that I have the source code of
I've been playing around with some leaked source codes and I find that locating a function in source in the compiled exe is not so straight forward. And i'm thinking what are the ways to get that ...
- 3
1
vote
1
answer
92
views
How to load mixed assemblies into IDA?
When loading a DLL that uses the CLR (.NET runtime) and contains native code, IDA (as of 8.4) will always prefer to load it as "Microsoft.Net assembly" with processor type "Microsoft ...
- 10.9k
0
votes
1
answer
66
views
How to split a variable into 2 variables in pseudo c code generated by IDA?
Some times IDA's decompiler translates more than variables into a single variable or an array of varibles, for example, I have 2 variables
A a; // size = 30h
B b; // size = 60h
but IDA gives
A arr[3];...
- 103
1
vote
1
answer
59
views
Which interrupt was called
cseg01:00046E80 sub_46E80 proc near ; CODE XREF: sub_46ED8+81p
cseg01:00046E80 ; sub_47164+6Dp
cseg01:00046E80 000 ...
- 363
2
votes
3
answers
3k
views
IDAPython: error executing init.py
When I open Ida Pro 8.3 I see an error message
IDAPython: error executing init.py:
No module named imp
Refer to the message window to see the full error log.
i have python 3.12.3 and i ran as ...
- 23
0
votes
1
answer
155
views
What is the meaning of *((_DWORD *)
I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below.
*((_DWORD *)a1 + 150) = 3;
*(_DWORD *)(a1 + 604) = 1;
I can't understand what is happening for this two ...
0
votes
1
answer
62
views
sp analysis failed - red marks in code
This is start of func:
https://imgur.com/n0jbT1E
This is end of func:
https://imgur.com/GiQQAYP
What means red mark "sp analysis failed"?
I looked in C++ source code of this disassembled ...
- 363
0
votes
1
answer
58
views
Shift operation and subtract in code
There is C++ code:
int16_t ** g_Meshes;
int32_t m_MeshPtrCount;
int16_t * g_MeshBase;
uint32_t *mesh_indices;
for (int i = 0; i < m_MeshPtrCount; i++)
{
g_Meshes[i] = &g_MeshBase[...
- 363
0
votes
1
answer
62
views
Сode in IDA breaks off
My code breaks off, and then the code color is red, like in the screenshot, a fragment of a function. What can you do here? How to restore the code? Is there a keyboard shortcut for this?
- 363
0
votes
0
answers
54
views
Hex-View in IDA [TMS320C3x]
For the target processor TMS320C3x, IDA does not display all data in HEX-VIEW as ASCII,
only every 4th byte.
The minimum addressable data block for this target processor is a 32-bit word.
It seems ...
- 96
0
votes
0
answers
60
views
How do I force IDA to reload PE Header and/or segments?
Introduction
I started analyzing an exe, added many comments, structs, byte patches, etc.
After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called "....
- 1
1
vote
0
answers
48
views
Unknown string encoding
I'm new to reverse, my question may be stupid.
I am trying to reverse a function in the application that reads a string at the address and concatenate it to another
char[250] v30;
char[20] v31;
...
...
- 11
0
votes
0
answers
31
views
How to access the demangled auto comment?
In this example, IDA has demangled the boost::fibers::context::active name normally, and you can access that name with ida_name.get_ea_name(ea, GN_SHORT|GN_DEMANGLED|GN_VISIBLE). But the function name,...
0
votes
0
answers
21
views
How can I use ptr to ptr in idapython?
in hey-rays api there's a method:
def find_def(self, *args) -> "minsn_t *":
r"""
find_def(self, op, p_i1, i2, fdflags) -> minsn_t
@param op: mop_t const &...
0
votes
0
answers
42
views
Ida Pro: how do I iterate over all typedefs in python
I see how to iterate over all structs, unions, enums, functions. But I cannot find a way to iterate over all typedefs.
- 101
2
votes
0
answers
60
views
Changing instruction that was misidentified in IDA Pro
I am trying to compare a source code to a disassembled version of a Sega Genesis (68000 processor) game. I ran the binary through IDA Pro 7.7 to disassemble it, and when I was going through the code ...
- 21
0
votes
1
answer
64
views
how to print non printable address using python
i have been doin ctf challenge and came across a problem when i have to push the address of a function into eip{instruction pointer} by overflowing the buffer but the main problem here is that the ...
0
votes
1
answer
64
views
Offset addressing
I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation:
in code I ...
- 13
0
votes
1
answer
146
views
IDA - Decoding this "XORed"? string automatically in psuedocode
__m128i ModuleName;
__m128i ProcName;
ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64;
ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64;
ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64;
ProcName....
0
votes
0
answers
29
views
I loaded an unpacked base and it broke some structs. How can I fix them?
So I, against my best judgement, loaded an unpacked base after IDA crashed on me. And despite thinking to make a backup before doing that, I didn't do it.
So now I'm stuck with 4 broken structs. The ...
- 21
0
votes
1
answer
141
views
Hooking a function
So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
- 1
2
votes
0
answers
171
views
Vtables in objects with inheritance in IDA
I'm struggling to get object inheritance working in IDA.
The original structure is as follows:
INoticeSource : INoticeSink
IRTTITypeInfo : IUnknown, INoticeSource
IPersist : IUnknown
IPersistStream : ...
- 21
0
votes
0
answers
51
views
Why a breakpoint works in x64dbg but not in IDA?
I've spent all morning trying to find a solution to debug with IDA the same function I'm debugging in x64dbg.
In x64dbg, I just go to Symbols -> ws2_32.dll -> WSARecvFrom -> F2 (set ...
- 161
0
votes
0
answers
61
views
Debug Linux Kernel ARM64
I need to extract Initramfs from the kernel.
The initramfs archive itself is encrypted and located inside the kernel.
I couldn't extract the key.
I thought to run the kernel in Qemu, connect with the ...
- 1
0
votes
0
answers
28
views
How can i generate function call tree in IDA & proper disassembly from obsucated flow?
I'm trying to properly disassembly the following code in IDA but failing to do that because code flow is obfuscated with call / jnz byte ptr [eax-2] how is it supposed to look like for IDA?
.text:...
- 1
0
votes
0
answers
55
views
IDA can't load DLL, possibly packed but how?
I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading:
So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
- 31