Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,398
questions
1
vote
1answer
25 views
Modify function to return a static value
i am learning IDA pro on a test binary and i'd like to return a static value to this function:
; __int64 __fastcall sub_B580(char *name)
sub_B580 proc near
pai= qword ptr -70h
req= addrinfo ptr -68h
...
0
votes
0answers
27 views
Easy way to understand vulnerable functions while Reversing
I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code.
As I am new to this stuff, I am getting some issues of ...
2
votes
1answer
111 views
Decompiler attack
I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.:
So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
0
votes
0answers
54 views
How do you mapped a stripped function back to it's real address?
So basically this is a stripped android 32bit ELF (it's just a linux dll with android handle it a bit different - NDK/JNI), and I unpacked it.
Now the function inside is cleaner and you can see ...
0
votes
0answers
39 views
Packet: Game last byte encrypted?
12:14
WSARecv()
C3-73-3E-BE-36-2F-14-37-37
F4-44-09-89-01-18-23-00-00
------------------------------------------
12:14
send()
C3-73-38-31-0E-35-EE-35-A5-35-7F-34-37-37-8D
F4-44-0F-06-39-02-D9-02-92-02-...
-1
votes
2answers
59 views
How to add a message box to a PE [on hold]
So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
-1
votes
0answers
31 views
Can any python coder help to port this OLLVM deobfuscator to ida v7 or below? [on hold]
FYI ida plugin can be py script or be c++. This blog written very well on how the deobfuscation concept work. https://rpis.ec/blog/dissection-llvm-obfuscator-p1/
I don't know anything about c++ or ...
0
votes
0answers
67 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
34 views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
1
vote
0answers
57 views
+100
Extracting instruction and operand information in IDA Python
I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
49 views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
95 views
How to decrypt the password using radare2 or gdb?
.--------------------------------------------------.
| [0x804851b] |
...
2
votes
0answers
49 views
Telling IDA that all references to an address range belong to the same segment
For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
2
votes
1answer
114 views
Unable to properly analyze a very simple C-compiled program
I'm a RE beginner and I decided to start writing my own simple code for practice.
I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
0
votes
0answers
36 views
How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW
Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW
i tried every combinanated value but without sucess.
0
votes
2answers
37 views
Error when changing push 0 to push function
Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure
I've searched for a fix for a while to no avail
help would ...
0
votes
0answers
10 views
Can the .idb/.i64 default save location be changed?
By default, IDA Pro saves its .idb (or .i64) files to the same directory as the file being analyzed. Is there a way to change this? I couldn't find anything related to this in Options -> General.
0
votes
1answer
50 views
What do square brackets do in IDA's pseudocode representation?
I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
2
votes
1answer
53 views
__security_cookie for function pointers in Windows 10
I'm curious about this __security_cookie that I keep seeing all over the msvcp140.dll from my Windows 10 x64 (insider build.)
Here's an example:
Note that the address for indirect function call (or ...
0
votes
0answers
31 views
IDA 7.0 (free) fails to load symbols with message “DWARF: Cannot determine location of DWARF info” during debugging
Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM:
Then loaded a test PE file and started debugging it (using Local Windows Debugger):
...
0
votes
1answer
48 views
How to help IDA to auto complete libc functions?
I have a x86_64 ELF binary which is statically compiled. With some digging,
I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code
shows sycalls as inline assembly code. But in ...
0
votes
1answer
32 views
Loading 8051 binary to IDA with ROM+External RAM configuration
I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses:
In this example the ROM size is ...
0
votes
1answer
71 views
Trying to understand *((_DWORD *) in IDA pro
Hi I am trying to understand pseudocode from this game I'm currently modifying.
if ( v11 == 501736410 ) // case 0x1DE7E3DA: //"Weapon"
{
*((_DWORD *)v6 + 326) = 3;
}
else if (...
1
vote
1answer
59 views
Is there a way to show exceptions handlers in Hex-Rays decompiler output?
Is there a way to show these exception handlers in the decompiled code?
I can't tell that a block is in a __try block without looking into the disassembly.
__int64 __fastcall ...
2
votes
1answer
56 views
How to migrate IDA/HexRays database to the new version of the same application?
I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this?
It seems that I need to compare ...
1
vote
0answers
80 views
removing bios wireless white listing
I am trying to remove the white listing for wireless cards from my Thinkpad L540 running Debian Buster. I did the following steps:
booted with kernel parameter iomem=relaxed
used pawn to dump BIOS
...
0
votes
0answers
25 views
Generate pseudo code not available for some binaries in IDA Pro
I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
0
votes
0answers
21 views
Find with IDA where an executable checks for devices plugged into computer
The executable is a firmware updater for a specific device.
I want to find where exactly does the executable checks for the devices plugged into the computer, before updating the firmware of the ...
1
vote
2answers
106 views
Patching JNZ (two byte opcode) into JMP near (one byte opcode)?
I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
1
vote
0answers
59 views
Reverse Engineering GUI programs
I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the ...
0
votes
1answer
33 views
Why does this command crash IDA Android native debugger?
In Android shared library that heavily protected against debugging, I found following code:
CODE32
ldr pc, [pc, #-4]
For me, this instruction looks like NOP; it just jumps to next instruction in ARM ...
1
vote
1answer
70 views
Using IDA Pro, How can I just “edit” values, Rather than patching Offsets,
Im a part of the iOSGods community, and they make lots of cheats, but they dont really do the best at teching other people how to do that.
Those people never reply to my help support topics on ...
0
votes
0answers
40 views
How to research the executable file of a game written using the Unreal Engine?
I want to make changes to the gameplay of a game written using the Unreal Engine.
To do this, I need to find the function that interests me, embed my DLL in the game process, and change the pointers.
...
1
vote
1answer
66 views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
0
votes
0answers
51 views
Reverse engineering complex GUI desktop application
I have an old program written in WinDev which connects to a HFSQL local database. Unfortunately, the developer of this app is unavailable, and I need access to the DB. the program folder contains ...
2
votes
1answer
77 views
Generating disassembly from raw Infineon Tricore 1971 binary
Is IDA the best disassembler for a raw Tricore TC1791 (or similar) binary? I see there are several others floating around.
Which programs are going to give us the most complete ASM from a raw binary? ...
0
votes
1answer
26 views
IDA Xrefs window keep open?
When I use the context menu "List cross references to", a window opens with a list of all positions found which references the position, and I can double click to a function. But then the window ...
0
votes
1answer
44 views
How to set virtual `T` register programmatically in IDA Python?
It is trivial to do it with Alt+G command from GUI.
However, when I set multiple breakpoints programmatically, IDA doesn't recognize them as "thumb" mode ones and sets T value at breakpoint address ...
2
votes
1answer
77 views
Start vs WinMain()
I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
1
vote
0answers
63 views
Ida permission error
I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
1
vote
0answers
44 views
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:
static native long ...
0
votes
1answer
77 views
The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?
The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
1answer
35 views
How to change IDA's name representation programmatically?
I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form
9 dseg_1234 the same as 2, but without data type ...
0
votes
1answer
75 views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
0
votes
0answers
34 views
Add MessageBox statically modify
So i'm doing this challenge which i have an exe file and a dll all i have to do is
modify it statically to pop a MessageBox.
The exe file is loading the dll which load the MessageBox, with ollydbg ...
1
vote
1answer
71 views
IDA Pro - Load data in manually created segment
The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string.
...
1
vote
1answer
52 views
IDA debugging a packed / encrypted library - retaining breakpoints / subroutine names set in debug segments
I am debugging a library that is heavily packed / encrypted. Here is a flowchart of the operation of this library and where I am at in my reverse engineering:
Assume it is not possible to modify ...
0
votes
1answer
65 views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
0
votes
0answers
91 views
Differences between IDA Pro and Radare2
I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows.
However, I know about radare2 and that it is open source,...
0
votes
0answers
41 views
Which API function is responsible for input strings?
I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
