Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
0
votes
0answers
43 views
IDA change string in rdata
This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php?
toquizwammer.github.io
Thanks.
0
votes
0answers
21 views
Changing pseudocode based on FPU fmul behaviour
A 3D software was compiled in which a typical x/4096f was translated as:
fmul ds:f4096
where f4096 equals to: 0.00024414062
Example decompiled pseudocode as-is:
skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
62 views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
0answers
30 views
Find offset in binary file
I have arm binary file that I can open with Ida, I want to find out the address of some bytes.
When I load the binary with Ida there is Image base address that the binary lodded and the offset of the ...
0
votes
0answers
40 views
0
votes
0answers
26 views
How to run python script in IDA PRO after each breakpoint?
I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error.
I'm trying to find something like '...
2
votes
1answer
81 views
IDA “unk_XXXXXX” meaning? [duplicate]
I am new to reverse engineering.
Today when looking at IDA, I found this
if ( *(_UNKNOWN **)(this + 8) == &unk_4EDC58 )
but I dont understand the part "unk_4EDC58".
So can you help me ? Thank ...
0
votes
0answers
16 views
use ida python to add a remark when calling a function using register
I want to add a remark for all non direct function calls.
e.g. say i have
mov EAX [functionEP]
call EAX
Assuming i have many such calls to various functions, I would like to run the debugger and ...
1
vote
0answers
23 views
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
37 views
How does Ida suspend threads?
I know that Ida uses ptrace function to attach and debug process.
How Ida can suspend thread? how is that possible?
0
votes
0answers
17 views
Stack trace with GdbServer
When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace.
Why? How can I fix it to see stack trace??
0
votes
1answer
30 views
In IDA, i want to get symbol by using IDAPython
I'm currently reversing some C++ Binary (macOS Kernel Extension).
But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython.
I know how to make structure ...
0
votes
0answers
48 views
How to debug apk/dex files in IDA Pro
Emulator Android 5.x.x
Tested on Nox, Memu. Did not give the result.
I'm use adb.
On emulator android 4.x.x works good.
0
votes
0answers
48 views
IDA pro - strange switch statement
I use IDA pro and along the analysis I try to understand the following function.
There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing.
Am I missing ...
0
votes
0answers
95 views
Anti-disassembler techniques and IDA Pro
I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
0
votes
1answer
354 views
How to deobfuscate native Android library obfuscated with OLLVM?
When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
0
votes
1answer
67 views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
0
votes
1answer
37 views
Finding function at offset loaded with ADRP/ADD
I have this assembly:
ADRP X8, #off_FFFFFFF006F1E960@PAGE
ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF
LDR X0, [X8] ; qword_FFFFFFF0077F08A8
LDR X8, [X0]
...
0
votes
1answer
109 views
Unable to decompile C Code
Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the ...
2
votes
2answers
71 views
Use idapython to print register or memory value when the debugger is running
I want to record the value of a certain register or specific memory location when the program is being debugged.
e.g. in the following segment:
.text:0FD6268D shr ecx, 4
.text:...
1
vote
1answer
55 views
GUARD_PAGE memory breakpoints with gdb?
I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)?
Ollydbg, x64dbg and IDA PRO all support these types of ...
0
votes
1answer
95 views
Disassembling Hexagon - Corrupted ELF
I downloaded and unpacked the modem from Google source, after that
I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says:
"Binary ...
1
vote
2answers
72 views
Permanently load a DLL to an executable
With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.
I've learnt that ...
0
votes
1answer
30 views
Is it possible to import an open source framework into a closed source project in ida?
I am working on reversing a closed source project that uses a well known open source framework.
I am thinking that theoretically, by diffing the program and the framework, I should at least get a few ...
2
votes
1answer
65 views
IDA memory mirroring
I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.
How do I setup IDA to recognise memory mirroring.
0
votes
1answer
57 views
IDA PRO Tracing stopps
I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
0
votes
0answers
42 views
How to disassemble .mbn files?
I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ?
I want to reverse qcom bootloader
0
votes
1answer
34 views
Stop currently running Ida Script mid execution
I ran an ida script and forgot to account for an infinite loop that keeps making a dialog pop up. Is there any keyboard command that will stop an Ida script from running mid execution? Thank you. I'm ...
1
vote
0answers
25 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
1
vote
1answer
100 views
Tool to search known hash/encryption algo in files in Windows
I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.).
I know an Ida plugin called FindCrypt2 but ...
1
vote
0answers
37 views
Is there a way to generate a PE from a web assembly module?
I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
1
vote
1answer
54 views
How to get IOCTLs from all NtDeviceIoControlFile function call?
Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from
NtDeviceIoControlFile() syscall. Here is an example of that syscall
in Beep() function in KernelBase.dll file:
In x86_64 (...
2
votes
1answer
45 views
Get all ordinals from local types view [closed]
Is there a way to get all ordinals of the local types view with the ida python api?
i have tried to get all ordinals for structs with: [ida_struct.get_struc(id).ordinal for _, id, _ in Structs()]. ...
0
votes
0answers
14 views
SIGBUS when trying to trace functions?
I am working on a crackme (Mach-O, mac app).
Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
1
vote
0answers
32 views
IDA map one memory address to another
I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
1
vote
0answers
58 views
Can anyone make much sense of this binary for an embedded system? [closed]
I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it.
...
1
vote
2answers
34 views
IDA - floating point operand type
How do I set the data to floating point number in quickier way than clicking on:
Edit>Operand type>Number>Floating point
I have a lot of wrongly detected casual DWORD's instead of Float's ...
0
votes
1answer
26 views
How to make IDA load headers of object files?
When I open an executable (a.out), I can see header info:
But when I load an object file, headers and segments aren't loaded:
The entire header section is skipped. It goes directly to main (starts ...
0
votes
2answers
54 views
IDA Pro not undefining assembly?
I am not sure if IDA is working correctly or not.
I have the instructions
call $+5
pop edi
If I understand this correctly, the program will jump forward, skipping some junk interpreted as ...
0
votes
1answer
61 views
Why Ida pseudo-code translate test as AND?
In IDA when disassembling a x86 EXE file there is a line
test byte ptr [ebp+XXX], cl
Before this line cl has a value of 0x11
The Hex-Rays decompiler plugin translates it as if (v10 &0x11).
Why ...
1
vote
2answers
91 views
Recommended way to modify assembler instructions in IDA
What is the easiest way (or is there any) to modify an instruction
inside a binary opened inside IDA and save the changes to the original?
Is there a builtin assembler who's output I can place at a ...
0
votes
0answers
39 views
Handling __int64 in IDA?
This is probably something very easy that I'm missing.
I have this operation
length_of_userInput = (signed int)(unsigned __int8)userInput >> 1;
And length_of_userInput is currently reading '...
0
votes
2answers
69 views
Bitwise operation between byte and 1?
I am having some trouble understanding what this is doing.
This is the commented pseudocode.
mightGetUserInput(&std::__1::cin, &userInput) ; this fills the buffer with the user input, ...
0
votes
1answer
80 views
Calling imported DLL functions from an injected DLL?
If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions?
I'm able to find the ...
0
votes
1answer
31 views
How do I set the return type for this type declaration?
I have a function that seems to calculate the length of a string.
I have made this type declaration and it does kind of work as IDA now flags the string correctly.
__int64 __fastcall strlen(char ...
0
votes
0answers
59 views
What is this function doing?
I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm.
And this is the relevant assembly:
mov rdi, [rbp+var_A80]
mov rsi, [rbp+var_A88]
...
0
votes
0answers
24 views
How to generate .TEXT only asm output in IDM?
So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
1
vote
0answers
29 views
How can I see specific memory value by using Hex view in IDA?
I'm about to use IDA pro.
I have to access to 0018F42C(EAX) by using Hex view in IDA.
Maybe I guess there is EAX value.(String is "happyy", standard input)
but Hex view shows me 0018F410 as in screen1....
0
votes
1answer
89 views
Tricore debugging tools
I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM.
Now I would like to learn about Tricore reverse engineering... ECUs mainly.
I can obtain the ECU ...
1
vote
0answers
41 views
Saving IDA Graph to PDF format?
I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that?
I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
