0

I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro.

I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is quite large.

I know it is supposed to be a 32 bit LSB binary, and Ghidra decompiles the same raw binary without any problems. However, I do prefer the IDA decompiler to Ghidra which is why I am trying to make it work in IDA as well.

The main problem is that the list of functions is missing (due to missing headers of course), but this does not seem to be a problem for Ghidra.

Is it possible to get the same result in IDA as I get in Ghidra? If so, how? What is the correct way to analyze raw binaries in IDA Pro / Hex-Rays?

Improve this question

1 Answer 1

Reset to default
0

Yes, it's possible.

In order to do that you should choose on the landing page the correct architecture: enter image description here

The file will open without any functions, in it's raw form.

Then go to the beginning of the file, press the left mouse button, hold shift key, and scroll to the bottom of the file.

When all the disassembly is selected press c button and choose analyze/force on the pop-up. That should do the trick.

Improve this answer
3
  • Thank you for providing an answer. I set the processor type to Intel 80686p to represent a somewhat similar CPU to Ghidras Intel/AMD 32-bit x86, and that somewhat worked, but after the analysis I had to convert certain labels to functions manually with p. The pseudocode after decompilation in IDA is still lacking certain parts that Ghidra has though.
    – Nicolai Prebensen
    Commented Oct 27, 2020 at 12:45
  • hex-rays.com/blog/igor-tip-of-the-week-04-more-selection
    – Igor Skochinsky ♦
    Commented Oct 27, 2020 at 13:21
  • Thank you Igor. Although I did not accomplish my goal since I am working with a custom CTF challenge file, this and the response of @macro_controller seems to be the correct answer to this question.
    – Nicolai Prebensen
    Commented Oct 30, 2020 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.