1

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it seems and hence 0 bytes of c file produced. I would like to put up the ida logs here for reference:

BinExport 9 (@a0efa77, Mar  8 2016), (c)2004-2011 zynamics GmbH,
(c)2011-           2016 Google Inc.

  bytes   pages size description
--------- ----- ---- --------------------------------------------  
16326656  1993 8192 allocating memory for b-tree...  
16326656  1993 8192 allocating memory for virtual array...  
262144      32 8192 allocating memory for name pointers...
-----------------------------------------------------------------  
32915456            total memory allocated

Loading processor module /Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/procs/pc64.imc64 for metapc...OK 

Autoanalysis subsystem has been initialized. Possible file format: Fat Mach-O file, 2. ARM64 (/Applications/IDA Pro
95/idaq64.app/Contents/MacOS/loaders/macho64.lmc64) 

Possible file format: Fat Mach-O file, 1. ARMv7 (/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/loaders/macho64.lmc64) Loading file
path to binary/binary' into database... 

Detected file format: Fat Mach-O file, 2. ARM64 Unloading IDP module /Applications/IDA Pro
95/idaq64.app/Contents/MacOS/procs/pc64.imc64... 

Loading processor module /Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/procs/arm64.imc64 for arm...OK

Type library 'macosx64' loaded. Applying types... 

Types applied to 0 names.

  0. Creating a new segment  (0000000100088000-0000000100264CAA) ... ... OK

entries start past the end of the indirect symbol table (reserved1 field greater than the table size) 

entries start past the end of the indirect symbol table (reserved1 field greater than the table size)

entries start past the end of the indirect symbol table (reserved1 field greater than the table size) 

IDAPython Hex-Rays bindings initialized. 

DWARF: Looking for Mach-O DWARF file at "path to binary/binary.dSYM/Contents/Resources/DWARF/binary"... 

DWARF: No.

Marking typical code sequences... Flushing buffers, please wait...ok

File '/path to binary/binary' has been successfully loaded into the database. 

Compiling file '/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/idc/ida.idc'... 

Executing function 'main'... Compiling file '/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/idc/onload.idc'... 

Executing function 'OnLoad'... IDA is analysing the input file... You may start to explore the input file right now.
---------------------------------------------------------------------------------------------------------- 
Python 2.7.10 (default, Feb  7 2017, 00:08:15)  [GCC 4.2.1 Compatible
Apple LLVM 8.0.0 (clang-800.0.34)]  IDAPython 64-bit v1.7.0 final
(serial 0) (c) The IDAPython Team <idapython@googlegroups.com>
---------------------------------------------------------------------------------------------------------- 
Propagating type information... 
Function argument information has beenpropagated 
The initial autoanalysis has been finished.

Being new to ida, I could not understand the exact reason, but I may guess that it's not able to find the main entry point..?? But then why if so??

Any clue or redirection to an appropriate helpful link would be really great. Thank you!

Update1:

I thought I should attach the ida screenshot as well.enter image description here

  • This seems to be a xar archive, not a mach-o file. – Igor Skochinsky Oct 17 '17 at 8:19
  • @IgorSkochinsky Thanks for the response. This is a decrypted binary file. I'm using the same way other decrypted binaries and it does decompile and shows me the functions, can produce the c file and see the decompiled code. – Rohit saraf Oct 17 '17 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.