Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
0
votes
0answers
13 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
1answer
34 views
MEMORY macro in IDA Pro pseudocode
I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example:
int S_u8init_flag = 0; // ...
1
vote
0answers
45 views
Using IDA to find pointer passed to procedure
Loading the source into IDA, I have this function:
According to the source for LUA, this function should be passed a pointer to the Lua_State struct:
LUA_API int lua_gettop (lua_State *L) {
return ...
2
votes
1answer
100 views
Is this really a function IDA could not decode?
I have the following IDA output:
BEGTEXT:00415A2C read_dpc_sub_415928 endp
BEGTEXT:00415A2C
BEGTEXT:00415A2C ; ---------------------------------------------------------------------------
BEGTEXT:...
0
votes
0answers
33 views
what is Ida Name Tab
I know what is Function tab (show all function) and what is String tab(show all string) and Import , Export ....
But what is Name tab? what should I expect see there? and how Ida get this information ...
0
votes
0answers
43 views
idapython - Scan all possible code paths between start and end addresses
I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
21 views
Changing a string pointer while debugging
I'm facing an issue, and I'm not sure what is the best way to handle it.
While debugging a program (x64, windows), the program copies certain string using
errno_t strncpy_s(char *restrict dest, ...
0
votes
1answer
78 views
How to find out address in binary file (like IDA) with python code only?
I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
0
votes
1answer
60 views
Ida - what is Parse C header file
In ida File->Load file there is option Parse C header file, I want to understand that .
If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
0
votes
0answers
20 views
IDA remote debugging - non printable characters in parameters
I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course.
My goal is the ability to debug with IDA the process with the ...
0
votes
0answers
52 views
IDA change string in rdata
This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php?
toquizwammer.github.io
Thanks.
0
votes
0answers
22 views
Changing pseudocode based on FPU fmul behaviour
A 3D software was compiled in which a typical x/4096f was translated as:
fmul ds:f4096
where f4096 equals to: 0.00024414062
Example decompiled pseudocode as-is:
skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
78 views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
0answers
52 views
0
votes
0answers
34 views
How to run python script in IDA PRO after each breakpoint?
I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error.
I'm trying to find something like '...
2
votes
1answer
88 views
IDA “unk_XXXXXX” meaning? [duplicate]
I am new to reverse engineering.
Today when looking at IDA, I found this
if ( *(_UNKNOWN **)(this + 8) == &unk_4EDC58 )
but I dont understand the part "unk_4EDC58".
So can you help me ? Thank ...
0
votes
0answers
18 views
use ida python to add a remark when calling a function using register
I want to add a remark for all non direct function calls.
e.g. say i have
mov EAX [functionEP]
call EAX
Assuming i have many such calls to various functions, I would like to run the debugger and ...
1
vote
0answers
25 views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
37 views
How does Ida suspend threads?
I know that Ida uses ptrace function to attach and debug process.
How Ida can suspend thread? how is that possible?
0
votes
0answers
17 views
Stack trace with GdbServer
When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace.
Why? How can I fix it to see stack trace??
0
votes
1answer
36 views
In IDA, i want to get symbol by using IDAPython
I'm currently reversing some C++ Binary (macOS Kernel Extension).
But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython.
I know how to make structure ...
0
votes
0answers
54 views
IDA pro - strange switch statement
I use IDA pro and along the analysis I try to understand the following function.
There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing.
Am I missing ...
0
votes
0answers
122 views
Anti-disassembler techniques and IDA Pro
I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
0
votes
1answer
387 views
How to deobfuscate native Android library obfuscated with OLLVM?
When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
0
votes
1answer
109 views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
0
votes
1answer
46 views
Finding function at offset loaded with ADRP/ADD
I have this assembly:
ADRP X8, #off_FFFFFFF006F1E960@PAGE
ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF
LDR X0, [X8] ; qword_FFFFFFF0077F08A8
LDR X8, [X0]
...
0
votes
1answer
124 views
Unable to decompile C Code
Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the ...
2
votes
2answers
100 views
Use idapython to print register or memory value when the debugger is running
I want to record the value of a certain register or specific memory location when the program is being debugged.
e.g. in the following segment:
.text:0FD6268D shr ecx, 4
.text:...
1
vote
1answer
56 views
GUARD_PAGE memory breakpoints with gdb?
I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)?
Ollydbg, x64dbg and IDA PRO all support these types of ...
0
votes
1answer
116 views
Disassembling Hexagon - Corrupted ELF
I downloaded and unpacked the modem from Google source, after that
I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says:
"Binary ...
1
vote
2answers
79 views
Permanently load a DLL to an executable
With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.
I've learnt that ...
0
votes
1answer
32 views
Is it possible to import an open source framework into a closed source project in ida?
I am working on reversing a closed source project that uses a well known open source framework.
I am thinking that theoretically, by diffing the program and the framework, I should at least get a few ...
2
votes
1answer
88 views
IDA memory mirroring
I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.
How do I setup IDA to recognise memory mirroring.
0
votes
1answer
61 views
IDA PRO Tracing stopps
I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
0
votes
0answers
50 views
How to disassemble .mbn files?
I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ?
I want to reverse qcom bootloader
0
votes
2answers
67 views
Stop currently running Ida Script mid execution
I ran an ida script and forgot to account for an infinite loop that keeps making a dialog pop up. Is there any keyboard command that will stop an Ida script from running mid execution? Thank you. I'm ...
1
vote
0answers
28 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
1
vote
1answer
104 views
Tool to search known hash/encryption algo in files in Windows
I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.).
I know an Ida plugin called FindCrypt2 but ...
1
vote
0answers
39 views
Is there a way to generate a PE from a web assembly module?
I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
1
vote
1answer
61 views
How to get IOCTLs from all NtDeviceIoControlFile function call?
Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from
NtDeviceIoControlFile() syscall. Here is an example of that syscall
in Beep() function in KernelBase.dll file:
In x86_64 (...
2
votes
1answer
61 views
Get all ordinals from local types view [closed]
Is there a way to get all ordinals of the local types view with the ida python api?
i have tried to get all ordinals for structs with: [ida_struct.get_struc(id).ordinal for _, id, _ in Structs()]. ...
0
votes
0answers
16 views
SIGBUS when trying to trace functions?
I am working on a crackme (Mach-O, mac app).
Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
1
vote
0answers
36 views
IDA map one memory address to another
I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
1
vote
0answers
60 views
Can anyone make much sense of this binary for an embedded system? [closed]
I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it.
...
1
vote
2answers
37 views
IDA - floating point operand type
How do I set the data to floating point number in quickier way than clicking on:
Edit>Operand type>Number>Floating point
I have a lot of wrongly detected casual DWORD's instead of Float's ...
0
votes
1answer
27 views
How to make IDA load headers of object files?
When I open an executable (a.out), I can see header info:
But when I load an object file, headers and segments aren't loaded:
The entire header section is skipped. It goes directly to main (starts ...
0
votes
2answers
63 views
IDA Pro not undefining assembly?
I am not sure if IDA is working correctly or not.
I have the instructions
call $+5
pop edi
If I understand this correctly, the program will jump forward, skipping some junk interpreted as ...
0
votes
1answer
67 views
Why Ida pseudo-code translate test as AND?
In IDA when disassembling a x86 EXE file there is a line
test byte ptr [ebp+XXX], cl
Before this line cl has a value of 0x11
The Hex-Rays decompiler plugin translates it as if (v10 &0x11).
Why ...
1
vote
1answer
152 views
Recommended way to modify assembler instructions in IDA
What is the easiest way (or is there any) to modify an instruction
inside a binary opened inside IDA and save the changes to the original?
Is there a builtin assembler who's output I can place at a ...
0
votes
0answers
43 views
Handling __int64 in IDA?
This is probably something very easy that I'm missing.
I have this operation
length_of_userInput = (signed int)(unsigned __int8)userInput >> 1;
And length_of_userInput is currently reading '...
