Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,359
questions
1
vote
0answers
29 views
Ida permission error
I tried opening an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
1
vote
0answers
30 views
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:
static native long ...
0
votes
1answer
56 views
The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?
The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
1answer
27 views
How to change IDA's name representation programmatically?
I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form
9 dseg_1234 the same as 2, but without data type ...
0
votes
1answer
44 views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
0
votes
0answers
26 views
Add MessageBox statically modify
So i'm doing this challenge which i have an exe file and a dll all i have to do is
modify it statically to pop a MessageBox.
The exe file is loading the dll which load the MessageBox, with ollydbg ...
1
vote
1answer
39 views
IDA Pro - Load data in manually created segment
The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string.
...
1
vote
1answer
38 views
IDA debugging a packed / encrypted library - retaining breakpoints / subroutine names set in debug segments
I am debugging a library that is heavily packed / encrypted. Here is a flowchart of the operation of this library and where I am at in my reverse engineering:
Assume it is not possible to modify ...
0
votes
1answer
37 views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
0
votes
0answers
49 views
Differences between IDA Pro and Radare2
I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows.
However, I know about radare2 and that it is open source,...
0
votes
0answers
37 views
Which API function is responsible for input strings?
I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
0
votes
0answers
31 views
What does mean cs:Memory on IDA pro? [duplicate]
I don't understand the meaning of cs: Memory.
Please help me.
0
votes
0answers
11 views
IDA Pro break on system call to stat64
Upon running strace of an android x86 program I am debugging I notice a large section of stat64 like this:
stat64("/data/data/com.topjohnwu.magisk/", 0xbfbf2ef4) = -1 ENOENT (No such file or ...
0
votes
1answer
49 views
IDA and flirt signatures
I have 2 binaries, with the same CPU architecture.
I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it.
I put the ...
0
votes
0answers
49 views
IDA free : How to find a string reference in .text
To begin with, I'd like to point out that I'm very new to this.
Here's the simple thing I'd like to do :
The program I want to mess around with displays a msgbox with the string "Please run the ...
0
votes
0answers
100 views
Decrypting Lua Files from game
I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki).
Links to files of game:
libhellolua.so (cocos2dx external library)
example encrypted LUA-scripts (*.abc files)
I was reading a ...
0
votes
0answers
46 views
IDAPython - Find the start of an undefined code blob
I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.
I'm in a case where some portions of my code contain this type of anti-...
2
votes
1answer
98 views
Can Ghidra do backward symbolic execution?
I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
1
vote
0answers
19 views
IDA losses renaming and functions border data when debugger starts: is there any workaround?
I try to use IDA to debug Android application. As always, I perform static analysis first and rename registers, memory locations, jumps, etc, to make assembly code more readable.
However, as soon as ...
0
votes
0answers
28 views
faster kernel debugging in IDA (not VMWARE)
I am debugging ESX server in kernel mode(windows).
I use windbg debugging through COM PORT(eventually).
Can I get VirtualKD to work in this scenario?
Suspending IDA takes more than a few seconds(...
1
vote
1answer
49 views
MakeArray from stack variables using idapython
I want to MakeArray() to stack variables which can be done with IDA like so:
MakeArray() Create an array.
ea - linear address
nitems - size of array in items
This ...
0
votes
1answer
60 views
Remote debugging using IDA, connecting to windbg server (kernel mode)
I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
1
vote
0answers
25 views
Debugging arbitrary ARM binary image using IDA and QEMU
i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
1
vote
0answers
70 views
How does IDA apply its FLIRT signatures and how are they licenced?
I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
0
votes
1answer
42 views
How to remove line? [Help with CTF]
Hi!
So, the program print me a Flag length is 32. As I understand call strlen convert my flag to string of length. So, I want to remove that part call strlen or somehow avoid it (maybe I'm not right ...
2
votes
1answer
200 views
Decrypting Lua Files
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.
...
1
vote
2answers
65 views
Bochs x86 16bit and IDA dissasembly
I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says "wrong segmentation". Loading in ...
0
votes
1answer
45 views
IDAPython newbie question
The following call gets executed many times and jumps to many subroutines.
call [rbp+var_s38]
What do I need to write in the breakline condition to export all the locations it jumps to?
import ...
0
votes
1answer
52 views
Change IDA pro dissassembly to linear sweep
I would like to know if there is any way to modify the algorithm used in IDA pro. I have a binary where I suspect that junk isn't junk, and I would like to see what output would a linear disassembly ...
1
vote
2answers
60 views
Split IDA segment into sub segments
I'm reversing a firmware, that comes in one big binary chunk(.bin file).
After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
1answer
29 views
Exported DLL function has only stdcall with some offset
I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this:
IDA pseudocode:
int __stdcall ...
0
votes
2answers
49 views
Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro
Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis.
cseg04:3044 loc_105D4: ; ...
0
votes
1answer
42 views
Why won't IDA let me name this variable?
I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it.
The name didn't propagate over to the program, as you can see in the mov ...
1
vote
1answer
28 views
Confused about address being referenced
lea ebp, dword_403638
lea ebx, [ebp-4]
mov edi, ss:[ebx]
I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
0
votes
1answer
33 views
Building micro controller memory image in IDA
I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format.
Some relevant information from the datasheet:
...
0
votes
0answers
27 views
IDA taking forever to run autoanalysis on remote Android app?
I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
0
votes
0answers
42 views
Save ida64 database as 32-bit
I accidentally ran ida64 on a 32-bit binary so I can't use the decompiler. Can I save it as a 32-bit database so I can open it in ida?
1
vote
1answer
47 views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
1
vote
2answers
93 views
Dealing With x86 Segmentation Overlaps
I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly.
I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
0
votes
1answer
30 views
IDA Pro jump to offset of DWORD
I have the following instruction in IDAs Decompiler:
result = data[3 * a1] + ptr;
and would like to know what is at the position if a1=60.
So I have to look at data[180]. Unfortunately all I see ...
0
votes
1answer
109 views
Weird IDA/Decompiler floating point output
I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before.
// a2 is always 60.0
void some_function(struct_123 *this, float a1, float a2)
{
...
0
votes
1answer
76 views
IDA 7 not dissasembling NEC v20 code
So I have an embedded machine from the late 80s I want to mess around with. It uses a NEC v20HL which is an 8088 compatible with some extra 80186 instructions tossed in. I know it uses 64k code ...
0
votes
1answer
228 views
how can i decrypt huawei HG531s v1 config file?
I have tried to follow this guide but
libxmlapi.so didn't have the required ATP_GetInfo1 function
so i moved to the next file libhttpapi.so
it had
ATP_GetInfo1
ATP_GetInfo2
ATP_GetInfo3
...
1
vote
2answers
119 views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
2
votes
2answers
97 views
How can I pass input to my program while debugging it with IDA
I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
0
votes
1answer
87 views
Identify function in cpp static binary
When I open cpp static binary, how can Identify known function like fopen/ioctl/printf ? They compile statistically into binary
I dont know the compiler of this binary .
2
votes
1answer
94 views
Finding address in IDA from address found in Cheat Engine
I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
0
votes
0answers
46 views
Decode message in esoteric audio file
I'm having a reverse engineering lab at school and my last project is to beat a 10 level reverse engineering CTF-like challenge. It's got plenty of interesting things. What I need to do is find a ...
0
votes
1answer
69 views
IDA freeware (v7.0) exporting Hex-View A
I'd like to export the Hex View generated from IDA to a file with the addresses intact similar to the .LST files generated for assembly instructions.
The closest I've come to generating this file is ...
0
votes
1answer
65 views
IdaPython aob search and rename example
Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying ...
