3

I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.

On the graph view it is only showing the main function, which is different to the screenshot in the tutorial. Also, I get the below errors about signature files:

Could not find signature file 'vc32_14'

Could not find signature file 'vc32ucrt'

Unless I am mistaken, I think it is because I need to use an older version of IDA which includes those signature files, or I need to find the signature files and put them into C:\Program Files\IDA Freeware 8.2\sig\pc where they are currently missing.

A) Where can I download IDA Free version 7.2 because the Hex-Rays website is only showing the newer version 8.2

B) Additionally, is there a place where I could download missing signature files

Edit:

First signature error

Second signature error

Loaded

Improve this question
8
  • 1
    Please show us a screen shot of your IDA, then we will understand what is different. The default file layout of IDA looks different, you can try to enter the "block flow mode" (or what ever it is called) by pressing space. The error message may simply indicator that IDA Free does not contain FLIRT signature files.
    – Robert
    Mar 31 at 16:58
  • @Robert Please see the update. My first priority is to resolve the signature errors, it appears older versions of IDA include those missing signatures but I cannot find a download anywhere. Next, is why it took me to a single block, whereas the tutorial shows several blocks joined together.
    – securityauditor
    Apr 4 at 14:25
  • Even paying customers don't have access to older IDA versions. HexRays always only provides the latest version of their software products. If you want older versions you have to download them when they are available and keep them. So the only way to get an older version of IDA Free is to check non-official servers and search for older versions.
    – Robert
    Apr 4 at 14:29
  • The screen shot of the tutorial is low res so it is not visible which function (or better which address) it displays.Event the text does not mention the address of the shown function. You simply have selected a different function that does not make use of conditional branch ops (if ... in C code) . Select different functions of the executable and try to find the one that has a similar graphical layout.
    – Robert
    Apr 4 at 14:34
  • 2
    Seems like the tutorial is simply not that exact, it also mentions that you should see see something like this. You simply have to select the correct function. Most likely the function you search is at address 0x00401159. Press g and then enter 401159 to go to this function.
    – Robert
    Apr 4 at 14:50

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.