Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,786
questions
1
vote
0answers
15 views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
2
votes
1answer
58 views
32 bit vs 64 bit IDA Pro
I am confused on the differences between using 64 bit and 32 bit IDA versions on a 32 bit application.
If I use 64 bit IDA on the 32 bit application, will it make use of 64 bit or 32 bit architecture?
2
votes
0answers
61 views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
1
vote
0answers
28 views
Getting all instances of Local type in Ida
I create a local type in Ida and put in some places this local type.
How can I got all the references to dhat Local type?
0
votes
1answer
92 views
IDA analysing a PE file now for 7 days+
So i am pretty new to IDA (64bit) / reverse engineering and i got a few questions. Currently i have IDA pro 7.5 on Windows 10.
First question: I am currently analysing a dumped (bypassed the anti ...
0
votes
0answers
66 views
Is this native code possible for further static analysis?
I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
3
votes
1answer
44 views
alignment in Ghidra and IDA
I see in my IDA it does automatically "align 10" after the end of a fucntion.
I wanted to know how to make the same in Ghidra manually like IDA does.
Thanks
1
vote
1answer
54 views
IDA 7.5 Show the Progress from Auto Analysis?
Is it possible to create a box / bar in IDA wich indicates the progress?
0
votes
2answers
39 views
Breaking on string access from StringTable (resource)
If I have a resource like this:
STRINGTABLE
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
{
100, "OK"
101, "Warning"
102, "Error"
103, "Name"
104, &...
0
votes
0answers
38 views
How can I connect basic blocks seperated by unconditional jmps?
I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like:
I wrote an IDAPython ...
-1
votes
1answer
69 views
How to understand the result of disassembling IDA Pro (dll x86_64)
I'm studying the dll that was built for x86_64.
I study where there are links to the function "call_f1_1806F3630" and do not understand three of them. Are these features of OOP? Help me ...
2
votes
1answer
41 views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
1
vote
0answers
39 views
The method of searching for similar code in a binary file of a new release
Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
1
vote
1answer
62 views
Is there a way to attach x86dbg with ida pro?
IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?
0
votes
0answers
34 views
what do these assembly codes doing? [duplicate]
I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this
public static String v = sUQWWyTBEs().toString().substring(32,...
1
vote
1answer
33 views
1
vote
1answer
56 views
IDA Pro, How to forcefully disassemble “mips 32” instead of “mips 16”?
While disassembling a mips binary, IDA Pro attempts to disassemble into mips 16 mode, even though It's mips 32 ISA.
Below is that code snippet.
.text:XXXXXXXX .set nomips16 # <= ??
.text:...
0
votes
1answer
24 views
Can't add tracing in IDA, showing it in gray
I added read/write trace to a program. I was able to record the trace with IDA for the first time.
When I run it again, it didn't work.
I tried to do what I did on the first time, adding the read/...
1
vote
1answer
53 views
How to load modules symbols to IDA while debugging a process
I am debugging a program that I compiled.
This program calls SetWindowTextW.
When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there:
If I will load ...
2
votes
2answers
338 views
How to convert to float
.rdata:00414704 __real@c0800000 dd 0C0800000h
How to convert this value 0C0800000h to float point number?
1
vote
0answers
33 views
Automotive engine management - reversing a PIN that has locked an MTX8 ECU
I'm after advice on how to identify a PIN that has been accidently entered and has locked an automotive ECU making it useless. The problem is resolvable by sending the computer back to the ...
0
votes
0answers
30 views
How to identify packer/encryptor of .so file
How could this file be encrypted?
detectiteasy didn't detect anything
3
votes
2answers
180 views
What does this ARM assembly code do?
I'm trying to figure out the password that is used to access the U-Boot shell, as mentoined in my previous question.
I'm having trouble understanding how exactly the code works.
Here is an image of ...
2
votes
1answer
49 views
Can't debug process with IDA Windbg debugger: “Could not initialize WinDbg engine with error: %1 is not a valid Win32 application”
I tried to debug a C++ that I created but I am getting the following error:
I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
0
votes
0answers
45 views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
0
votes
0answers
26 views
Automated data tracking during runtime in IDA PRO
What I mean specifically is that I want to turn a certain piece of memory into a virus that will attach itself to anything that has anything to do with it. For example:
call sub_404505
; Lets say that ...
0
votes
0answers
63 views
Loading a U-Boot ARM flash image into IDA Pro
I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
1
vote
0answers
40 views
Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?
Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to ...
1
vote
1answer
64 views
Reverse engineer sticky notes to allow external script to open new notes
For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
1
vote
1answer
47 views
IDA Pro - How to remove multi-line bit definitions for register
I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
0
votes
0answers
30 views
IDA Pro - reverse Program while it's
So, I have a program where I can load scripts into the program when running it. Is there any way to see what is going there with the help of IDA? Because normally IDA debugs the whole program and goes ...
1
vote
1answer
57 views
Remote debugging android native lib(.so) No connection could be made because the target machine actively refused it. when connecting to
I have a running IDA debug-server on my virtual android device(check attachments).
The problem is: when I try hit Attach procces it gives me an error(check title).
Here is some kinda params that I'm ...
0
votes
1answer
51 views
IDA pro 7.5.2 fails to find python.dll even tho it is in the correct folder?
Anyone ever have this problem? how can it be fixed? Installed ida pro 7.5.2 the other day in the python folder it has two files named 2 and 3 clearly for python 2 or 3 but its not even finding the ...
2
votes
2answers
82 views
ida_hexrays.lvar_t.stk.get_stkoff() incorrect ± 0x10
When using the stack offset for a variable obtained via ida_hexrays.lvar_t.stk.get_stkoff() or ida_hexrays.vdloc_t.stkoff() the results vary between "correct", and 8 or 16 bytes out as ...
2
votes
0answers
49 views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
1
vote
0answers
28 views
How do I disassemble mips .o object files in ida elf 64bit
So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
0
votes
0answers
42 views
Unrecognized function
There is function:
push 65h
push edi
call sub_5D8750
In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
2
votes
1answer
76 views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
0
votes
0answers
26 views
Can't figure out the type of hash
I know that SHA-1 is a cryptographic hash and it takes 20-byte and this is an example of it 64C1F7689B32D9805C5A1D5DABF3EAD31446B80C
The problem is with iirc,
I'm working in a small project, and ...
-1
votes
1answer
98 views
Finding some specific adresses in an exe file
I'm an absolutely beginner in the reverse engineering field.
I've an exe program and I should find : address of main function/address of function that validate user input/address of hardcoded password....
0
votes
1answer
93 views
How do I find missing/undefined vtable functions in IDA64?
I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them?
(*(BaseClient->int640 + 304))(...
3
votes
2answers
92 views
Force IDA to reanalyze a function recursively?
How can i force IDA to re analyze a function recursively (meaning including every function inside of it and so on) and recognize all the functions inside of all the functions? because right now when a ...
0
votes
0answers
21 views
Decompiler view of IDA pro when debugging windows kernel shows the content of every variable as “?”?
When Im debugging windows kernel using IDA pro and i am using the decompiler, it does not show the content of ANY variable, when i hover the mouse to any variable, it just says "?" ??
how to ...
1
vote
0answers
16 views
How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?
Lets say there is a variable x in f1, and f1 calls f2 with the variable x
I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
0
votes
2answers
59 views
Import header files in IDA to get the struct definitions?
I am reversing a program that has a lot of internal structs in it.
The problem is that there are a lot of structs, so i can't import them manually using local types->insert.
Lets say i have some ...
1
vote
1answer
47 views
Define partial struct with IDA
I want to define struct in Ida , but I know only partial of this struct
I only know that in arr[12] that int student_id , and I don't know the rest of struct. Ida recognize that struct as char * .
How ...
1
vote
1answer
37 views
Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?
I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
1
vote
1answer
63 views
Merging a large number of segments in IDA Pro
I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
2
votes
3answers
142 views
How can I view the output of printf calls without a console window?
I'm using IDA to poke around in an old video game and noticed there are lots of calls to the printf function:
I can see in another function that dword_5CE914 is a bitmask comprising various startup ...
0
votes
0answers
27 views
Can I find out what methods are being swizzled in runtime?
I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
