Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,652
questions
0
votes
0answers
7 views
Patching swift methods
The following is taken from a de-compiled iOS app.
Is this a swift method?
Is it objective-c derived?
Why is it showing in IDA as EXPORT?
Can this be patched to return 1?
EXPORT _$...
0
votes
0answers
22 views
Edit IDA signal handler
In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application.
How can I edit that choose now? I want to ignore this ...
0
votes
0answers
36 views
trying to understand this mov memory[register] instruction
Windows 10, IDA Home, 64bit application compiled with Visual Studio.
I'm reverse engineering a crackme and i found this instruction :
mov cl, byte_51B000[eax]
mov byte_51B018[edx], cl
in ...
-1
votes
0answers
42 views
Will ida pro have the following features?
First of all, I'm sorry if it's not smooth because it's a translator.
I am checking the value of a specific variable using the “watch view” of ida pro.
I want to see all the data as a hex string(in ...
0
votes
0answers
29 views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
0
votes
1answer
60 views
Find out the name of constants and var in IDA pro
I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I ...
0
votes
1answer
69 views
How to inform Hex-Rays decompiler (7.0) of known register values?
I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
0
votes
1answer
62 views
what is Off in IDA Pro?
probably silly question, what does Off ... means in IDA Pro?
i markered the snapshot as an example.
0
votes
0answers
40 views
how to get all “called functions” in idapython
I am using following function to generate a call graph using idapython:
def generate_graph():
callees = dict()
# loop through all functions
for function_ea in idautils.Functions():
...
0
votes
1answer
30 views
Problem when opening a script file in IDA (syntax error)(pe_sections.idc)
I downloaded the script files from http://www.openrce.org/downloads/details/57/PE_Scripts.
Then i extracted the files in the folder idc in the IDA folder (C:\Program Files\IDA 7.0\idc)
I opened IDA (...
0
votes
0answers
49 views
idapython: how to apply hexrays types to disassembly interface
I am using idapro 7.5 to get variable information from binaries.
Consider following simple code:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
int i, N, ...
2
votes
1answer
62 views
WinDBG doesn't resolve function names when debugging kernel module
I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).
Here is a picture ...
0
votes
1answer
33 views
How to run a process with high privileges using remote debugging
I am using remote debugging with IDA. The target and host machine are Windows.
I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
1
vote
1answer
63 views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
0
votes
0answers
21 views
ida: a better way of printing ida script output on console
I just started exploring ida. I have a simple IDAPython script.
import sys
import idc
import idautils
# wait for auto-analysis to complete
idc.auto_wait()
for ea in idautils.Functions():
print(idc....
0
votes
1answer
70 views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
0
votes
1answer
49 views
A bit confusion with cheat engine function address and IDA subrutine
I have found a function with Cheat Engine that I like to show in IDA:enter image description here
but the function is not present in IDA.
Probably I have a bit confusion becouse I don't have ...
1
vote
2answers
49 views
How to set conditional breakpoint to modify ZF (Zero flag)
In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0.
I don't know how to do it:
I searched for example scripts in IDC or ...
0
votes
2answers
49 views
Order of arguments in __usercall
i have the following function with five arguments:
; int __cdecl trampolineRegister(void)
a4= dword ptr 8
a5= dword ptr 0Ch
push ebp
mov ebp, esp
add eax, ...
0
votes
0answers
58 views
A way to detect a anti-cheating system
I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script:
debugProcess() -- Attach ...
0
votes
0answers
68 views
IDA IDC script does not seem to work
I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
0
votes
0answers
43 views
How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”
I have IDA 6.95, Python 2.7 and Python 3.7.
Currently when I start IDA it uses Python 2.7:
-----------------------------------------------------------------------------------------
Python 2.7.12 (v2.7....
0
votes
0answers
42 views
Address register offsets and analysis (Tricore)
I'm decompiling a binary file for a Infineon Tricore processor, the code is incomplete and only contains part of the code so will not execute. The auto analysis did a great job and the code is ...
1
vote
2answers
124 views
STL Data Structures Hex-Rays
We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure.
For example, std::...
1
vote
0answers
55 views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
0answers
16 views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
now there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
-1
votes
1answer
125 views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
0
votes
0answers
23 views
Failed to load .net binary on IDA Pro
I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file:
but when I click OK to load the program, the following error occured, and the program can't be loaded:
I tried to google ...
0
votes
1answer
27 views
Can't find sequence of bytes in IDA while debugging
While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44:
I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
0
votes
0answers
51 views
How to reverse engineer structs
I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
0answers
17 views
IDA, wrong jmp operand after patching
I'm writing a python script for IDA to automate the deobfuscation of a binary.
After patching with a jmp instruction ida provides the following disassembly:
.text:008FD01E jmp ...
-1
votes
1answer
61 views
IDA decompile binary file
how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
1
vote
1answer
62 views
Get a networkx graph from the the function call-graph of the file using IDApython?
Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
0answers
21 views
in ida pro 7+, what is the way to get a list of applied functions by signature?
I can only see the number of applied functions, but not the full list.
In the function window, there is no way to differentiate which signature lib is applied
0
votes
1answer
41 views
Packer changed memory in IDA?
I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it,...
0
votes
0answers
25 views
IDA - tracing strings
Is it possible for IDA to save string/memory content pointed by one of the registers during run-time?
-3
votes
1answer
156 views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
0
votes
1answer
77 views
What is the meaning of ARM LDAXR/STLXR instructions?
Often while disassembling ARM files, I see some code snippet with the following pattern:
loc_BB30:
.text:C0 FE 5F 88 LDAXR WZR, W0, [X22]
.text:00 04 00 51 SUB W0, W0, #1
.text:...
2
votes
1answer
46 views
Structure of operand bytes in .NET call and data access IL instructions?
I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions
for example based on experience, the last byte of API/...
-1
votes
1answer
65 views
What does xchg means when accessing array element?
I have ASM code of some Windows *.exe in IDA:
mov rax, [rbx+10h]
mov ecx, edx
xor edx, edx
xchg rdx, [rax+rcx*8]
Which is decompiled to pseudocode to
_RAX = this->m_someMemoryPool;
...
0
votes
0answers
24 views
C166 Memory and Addressing mode
Here I think I have some wrong in base concepts,
In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5.
So, we ...
0
votes
1answer
45 views
Get current file name with IDApython
I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.
the closest things ...
0
votes
0answers
24 views
How does Andriod .so files Reverse Engineering with a dissasembler like IDA pro and Cutter work
So few days ago going through youtube Reverse Engineering videos, i came across a particular video where an android application was modified using IDA pro by disassembling it's .so file found in /lib ...
0
votes
0answers
28 views
Doubts about a pointer in a DLL
I am working with the dll of a software in which I am not with access at the moment, analyzing the source code in static analysis tools, I realized that it receives a pointer as one of the parameters, ...
0
votes
1answer
55 views
Cant recognise where is my targeted function executed
Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here:
if (...
0
votes
0answers
14 views
How to get the color of a operand in IDApython?
Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
1answer
56 views
What is the use of moving a variable 3 times only to pass it back to the original register, with no calculations in between?
I'm reverse engineering a C++ binary using IDA, and there's one function that I don't quite understand.
x = dword ptr -8
var_4 = dword ptr -4
push rbp
movss rbp, rsp
sub rsp, 10h
movss [...
0
votes
0answers
79 views
C166/C167 code analyzing
Recently I try to reverse piece of assembly code that written for C166/C167 Arch.
But I have a problem with some places for convert to C code, such as:
loc_1892:
mov r9, #4
add r9, r0
mov ...
0
votes
0answers
18 views
Get the string usage sequence in each function with Idapython?
The only function i know for this task is idautils.Strings()
but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...
0
votes
0answers
30 views
Checking if a call is a API/Library call in IDApython?
I asked the question a while ago but found no answer so I'm trying my luck again
the only solution is this :
Finding all API calls in a function
but it doesn't work when the library call is a .NET ...
