Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,604
questions
0
votes
0answers
9 views
Using IDAPython Problem in finding string avalilable in .idata section
I am new to ida pro and idapython
In the following case i want to find the string reference "x is less than zero" while processing a block.
Tested with following script but doesn't seems to ...
0
votes
0answers
10 views
IDA hex != String
, Hello. to learn reverse engineering, I would like to simply change a string via IDA.
I select my string, get the adress, and select Change Bytes to get the Hex value :
After That, I try to convert ...
0
votes
0answers
35 views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
0answers
29 views
Debug dll file used in python script IDA
I am fairly new to RE on windows.
I have a python script which via ctypes uses functions from a dll.
I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
0
votes
0answers
50 views
Fix bad calling conventions in IDA
A binary I am studying puts the this pointer in rcx, followed by the rest of its arguments as its default convention. For some reason, IDA defaults to fastcall, but ignores the this pointer. This ...
0
votes
2answers
63 views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
0answers
31 views
N64 ROM file index hacking issue
Alright, I downloaded the N64 SDK and compiled one of the samples provided by the SDK and dissembled the ROM with IDA and found the asset data is stored some way using index's so my question is.
What ...
1
vote
0answers
37 views
Frida not able to trace sub_XXXXX which must have been called
I have the following pseudocode generated by IDA Pro decompiler:
__int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>)
{
...
result = ...
2
votes
1answer
57 views
Reconstructing a PE from unpacked memory in IDA
I’m trying to byte patch a 12 year old program written in MS Visual C++ V9. However, some of its code has been packed with ‘Lock Express V2.0’. I’ve loaded the executable in IDA and run the Universal ...
0
votes
0answers
48 views
strange results with IDA (some function different Pseudo Code)
After show the pseudo code in IDA I see different results:
The function 4436C0 show different pseudo code.
For example:
result = sub_4376C0("vvcbb3.wav",v8,0);
and
result = sub_4376C0((int)...
0
votes
0answers
21 views
How to paint running code with Ida gdb-server
I running IDA that is connected to gdb-server and I am using idapython with sark.
I want to paint all lines that are running (while debug) in IDA.
How can I do that?
0
votes
0answers
25 views
Finding RAM value in IDA Pro
At line #9 of a function, I have a variable that points to a RAM Cell. Actually I have a WORD at address E1C4.
I would like to know how can I get value of this variable?
I find a location where used ...
0
votes
2answers
42 views
Decode xor data in IDA
I have code that looks like this:
byte_100031BA4 = v41;
byte_100031BA5 ^= 0x3Eu;
byte_100031BA6 ^= 0x47u;
LOBYTE(a1) = -9;
byte_100031BA7 ^= 0xF7u;
byte_100031BA8 ^= 0xA9u;
byte_100031BA9 ^= 0xE8u;
...
0
votes
1answer
46 views
How to run another IDA script using IDApython?
I'm using IDA batch scripting to run a script on a dataset of malware
the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
0
votes
0answers
43 views
Can I reverse engineer a DLL file and add SEH or some error handing codes to it?
I am using some DLL files in my Java application using JNI library.
The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
0
votes
1answer
36 views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
1
vote
1answer
59 views
Why does IDA Pro fail to add these constants?
I am trying to port Enrique Nissim's script from his presentation "Reverse Engineering and Bug Hunting on KMDF Drivers" to IDA 7.4. His original script can be found at:
https://github.com/...
1
vote
1answer
42 views
What is the easiest way to dump a REGION of memory in IDA pro?
I'm facing a problem that i need to dump a large region of memory with IDA pro
using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for ...
1
vote
0answers
46 views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
0
votes
0answers
37 views
IDA Freeware Debugger crash on attaching
I run a binary that I am trying to reverse engineer from terminal and when I try to attach it with IDA debugger it says "OOPS! Internal error 20099" occurred.
I am able to load the binary ...
1
vote
0answers
38 views
Is there any way to apply FLIRT signatures through a script like idapython?
I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
0
votes
1answer
57 views
IDA exported header full of errors
Im a noob when it comes to using reverse engineering tooling.
I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are ...
2
votes
2answers
40 views
How to call to function while debug
When I debugging remote process with gdb-server and Ida, and put breakpoint in the code, when the process stopped at this breakpoint how can I call to function and after that return to my code ?
3
votes
0answers
188 views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
0
votes
1answer
33 views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
2
votes
1answer
67 views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
1
vote
0answers
99 views
which has better pseudocode? IDA or Ghidra [closed]
I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
2answers
47 views
Defining operand as offset
I have an idapython script which automatically defines bytes as code by a predefined configuration.
The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
1
vote
1answer
42 views
Click-thru a virtual function in IDA
I'm reversing some stuff that has RTTI, so finding vftables is easy.
I have an instance of some class some_object, there is a method being called through its __vftable. The method_4 has a type of ...
1
vote
1answer
42 views
Results of radare2 are not correct
I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:
r2 = r2pipe.open(binary_file)
r2.cmd('aaa')
funcs = r2.cmdj('aflj')
len(funcs) is 461, but the number of functions got ...
0
votes
1answer
43 views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
2
votes
1answer
44 views
How to debugging activeX with Ida
When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.
How can I see this ActiveX code(where ...
0
votes
2answers
36 views
How to retrieve name of a variable defined in the data segment in IDA when no process is attached?
I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS).
push word ptr ds:8401h
Since I have ...
1
vote
1answer
31 views
Displaying Operands as Position Independent in IDA
I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format'
lea rdi, format
However, when ...
0
votes
0answers
18 views
How to work on diffing result generated by bindiff
I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython.
*work is like finding no basic blocks, no of edges
0
votes
0answers
40 views
Defeating Tall Call obfuscation or something similar
If you look at the image below, you will see that IDA Pro's static analysis fails because the function doesn't actually end up there. There is no ret, add esp, 0x20 or pop to free the arguments on the ...
0
votes
0answers
28 views
IDA SDK Assemble instruction
What's the method of assembling instructions in IDA SDK c language?
Is that possible by passing insn_t* or str like option available in IDA [Edit->Patch program->Assemble]
0
votes
1answer
32 views
How can I find the function that throws an error message in IDA Pro? [closed]
Let's suppose I want to use IDA Pro to debug a Windows PE64 application that always throws an error message at a specific point when being run. What steps would I have to take to find the specific ...
2
votes
1answer
50 views
Best way to quickly mark all lines as code in IDA?
I have a fairly large obfuscated program, and I need to mark all of the lines as code. I was able to do this in IDC by iterating through the lines and running MakeCode. It works for small amounts of ...
1
vote
0answers
30 views
How to clear all comments created in ida using funcap?
How to clear the comments created by funcap and restore database to it's previous state?
I tried reanalyzing the program but comments do not seems to go away from database.
Though, checking-off ...
2
votes
1answer
42 views
Two copies to store values
I have this a piece of code, disassembled DX:
.text:004386D3 push ecx
.text:004386D4 fld1
.text:004386D6 fstp [esp+26Ch+var_26C] ;load 1.0 value ...
2
votes
1answer
37 views
Register edx and CreateDevice function DX
I disassemble CreateDevice function from my DirectX code and commented each paratemer:
.text:0043F485 mov eax, [ebp+lpParam]
.text:0043F488 add eax, 730h
.text:...
0
votes
1answer
30 views
IDA No Search Results in Subview For Viable Address
I found an address of a function from the game AssaultCube, and the address is 0045BCA0. In IDA, I disassembled ac_client.exe as a portable executable and tried to search for that address in the ...
0
votes
0answers
26 views
Ida pro 6.5 (BATCH MODE)
I have a question related to IDA pro 6.5 batch mode. I want to disassemble (.exe) files and generate (.asm) files. I have executed the cmd command for this and generated an asm file too. But it does ...
1
vote
1answer
55 views
Variable var_4 filled with value -1
Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do?
mov [ebp+var_4], 0FFFFFFFFh
This is WinMain ...
0
votes
0answers
23 views
Setting processor specific options in IDA Python loader
I'm writing an IDA loader in Python for a MIPS system that uses offsets from GP to reference data. By manually setting GP in "Processor specific options", xrefs are working. But, I'd like to ...
2
votes
2answers
40 views
X86 access to global strings pattern
While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it.
.text:00002560 ...
1
vote
0answers
36 views
IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?
I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself.
Unedited function:
Corrected ...
0
votes
0answers
35 views
how to calculate no basic blocks of a function using IDAPython
I am new to IDA Pro, IDAPython want to calculate no of basic blocks and its location in a function using IDAPython, please share the code with library needed to import.
1
vote
0answers
51 views
Reverse engineering old mmo
I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and ...
