Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

0
votes
0answers
39 views

I want to hire IDA Pro / Hex Ray Reverse Engineer [on hold]

I want to hire IDA Pro / Hex Ray Reverse Engineer for some projects within the car industry. Can anyone point me in the right direction.
0
votes
1answer
24 views

How to see all of my changes in idb?

Is there ant way to see all of my changes in idb file ? All of variable in psudo code that I changed here name, all the funxtion I rename. I want to see all of this
0
votes
0answers
56 views

IDA Pro debugging Linux .so libs

I am trying to debug a library that a server application loads in. On an Ubuntu server I start a gdbserver like this: gdbserver localhost:23946 ./smallserver After this on my Windows, I load the ...
1
vote
2answers
29 views

IdaPython Get Call Destination for Register Operand

I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of ...
3
votes
1answer
101 views

Point-to analysis of IDA Pro

I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro. According to my personal ...
3
votes
1answer
35 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
1
vote
0answers
54 views

Need help understanding IDA Pro pseudocode

I am new into IDA and have some questions about the pseudocode in C. Could someone please explain to me the meaning of the following two lines: (*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
-1
votes
1answer
69 views

Analyze raw assembly using IDA Pro

I have a raw assembly dump i.e. .intel_syntax noprefix .bits 32 .global main main: push ebp ... And I know it's Intel x86 and the original function was most likely written in C. Now the ...
0
votes
0answers
37 views

How to get index register from the instruction in IDA?

I have the instruction: add edx, ds:dword_7BFC7A50[eax*4] i.e. add edx, [eax*4+7BFC7A50h] And I decode it via decode_insn(). Then I try to get the information about the second operand. I ...
1
vote
0answers
26 views

IDAPython: Get the operand string without any substitutions [duplicate]

I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset ...
1
vote
3answers
56 views

IDA Debug DLL with non exported function

I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that? Thanks so much./
4
votes
1answer
79 views

Need help identifying main processor for Roland synthesizer

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
0
votes
1answer
29 views

How to convert IDA Pseudo code casts to Array

I have a pseudo code in IDA which is as such consdering v5= 3838385024767399985LL v1 += 53 * *((char *)&v5 + i); In C-Friendly format this should be v1 += 53 * v5[i] Is there any way in IDA ...
-1
votes
0answers
26 views

IDA unable to resolve local var

I'm decompiling a function and as you can see I've finished most of the parts, yet still left some annoying v1 - 0x1D4 unsolved. Here v1 is EBP, so these annoying stuff must be local vars. Then why ...
1
vote
2answers
50 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
3
votes
2answers
278 views

Move twice, from and to the same location

I'm trying to reverse a function and I came across these lines inside the function: 1. call ds:HeapAlloc 2. mov [ebp+var_4], eax 3. mov eax, [ebp+var_4] Why is line 3 needed? If I need to ...
0
votes
0answers
57 views

IDA - Find Function via Arguments

I am looking for a specific function. I have the header file of the Target, thus the function declaration. IDA seems to know the Arguments passed to a function, so how can I match the Arguments in the ...
0
votes
0answers
24 views

Compare / highlight differences between 2 .dll files [duplicate]

so I have 2 .dlls and I was thinking if it's possible to easily compare/highlight the things that are different between the two with IDA or anything else you have in mind that could make that job ...
1
vote
1answer
77 views

How to find out all the locations that call an external function using ida pro?

I just want to find out all the locations that call the standard library function pthread_attr_getstack using ida pro. There is an entry in .plt: .plt:00015894 ; =============== S U B R O U T I N E ...
1
vote
1answer
49 views

Remove Binary from IDA Database

I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
1
vote
1answer
49 views

Windbg's “dt” equivalent in IDA?

I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)? Assuming of course I have the pdb file. Thank you :)
3
votes
1answer
68 views

Find MFC class memory layout automatically in IDA?

Background I was using IDA to reverse engineer an DLL which uses MFC100. I was reading Reversing an MFC application: How to find class memory layouts? and https://stackoverflow.com/questions/...
0
votes
0answers
34 views

How to find first/next instruction in IDA trace via IDC

Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...
0
votes
0answers
13 views

IDC - How to apply type - ApplyType?

How do I apply a type to function - no-matter what input I always get 0. Here is my script: // // This example shows how to get list of functions. // #include <idc.idc> static main() { ...
0
votes
0answers
51 views

How to change value in IDA pseudocode?

If I press F5in ida, I can see pseudocode. When I debug this pseudocode, I can see values of variables. How can I change the value of specific variable in pseudocode?
0
votes
0answers
45 views

Autor-resolve enumeration members?

How to make IDA auto-resolve integer constants into enumeration members when they are being used in a call? I've tried setting appropriate function types and then reanalysing the program but alias ...
2
votes
1answer
110 views

Why having a function with just one instruction

I decompiled a program where there is a function, which has only a single useful instruction which is xor eax, eax retn What it the purpose of having this in an extra function, instead of using xor ...
4
votes
1answer
71 views

How to get execution time of IDC script?

As a beginner I'm trying to disassemble a file with IDA Pro 6.8. I write some IDC script for time-consuming work. Now, I want to get the execution time of my script, but I can not find appropriate ...
1
vote
1answer
44 views

find a dialog in ida using resource hacker

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this: 5035 DIALOG 0, 0, 295, 163 STYLE DS_SETFONT | ...
1
vote
2answers
62 views

Monitor all changes done by function

What is the easiest way to track all changes before and after a specific function is executed. I know I can trace instruction but that may yield a long list of all command executed. I want to stop the ...
0
votes
1answer
33 views

IDAPython Script works from “Script File” but not when run with -S from Terminal

I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
1
vote
1answer
39 views

IDA plugin to view hex bytes similar to objdump

Is there a plugin or option in IDA that interleavs the hex bytes for each instruction similar to the output of objdump? I.e. like this: 1800035f1: ff 15 19 5a 00 00 callq *0x5a19(%rip) ...
0
votes
1answer
57 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
0
votes
1answer
56 views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
3
votes
1answer
54 views

Why IDA define negative offset?

a = byte ptr -19h Why offset from stack base can be a negative number ? Can anyone explain this for me please?
1
vote
1answer
56 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
0
votes
4answers
244 views

Older versions of IDA free?

I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither. Does ...
0
votes
0answers
33 views

IDA PRO - Database changes after some test

I noticed that after some debugging my database has many remarks and some changes which were not there during the initial analysis nor after the firs few debugging sessions. e.g. i see this is how to ...
0
votes
1answer
33 views

immediate value change when start debugging

I patch the code for my work. I have a problem with code patching. I use IDA pro 6.8. I added code like this. (Assembly) (Hex dump) mov eax, 638BACh --> B8 AC 8B 63 00 Not problem ...
2
votes
1answer
70 views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
1
vote
1answer
99 views

How to find V-Table in IDA? (Using class informer)

I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do). But how do i find them in IDA? I'...
2
votes
1answer
41 views

IDAPython Code <-> Data

I'm looking for a way, to make programmatically change of data type. This is the same as you press 'C' or 'D'. For example convert this: .text:00401008 unk_401008 db 55h ; U ; ...
2
votes
2answers
110 views

IDA PRO run patched program from debugger without creating new exe

Using IDA PRO, after making a few patched, can I run the patched program in the debugger? What I have been doing so far is: 1. Edit > Patch Program > Apply patch to input file… 2. Save in a specific ...
-3
votes
1answer
48 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
1
vote
1answer
88 views

IDA PRO “try{” comment

2 related questions: I noticed that in some of the blocks in the graph there are more branches that I would expect. These are not jump tables yes I see, e.g. 3 possible branches. How come? The 2nd ...
0
votes
0answers
57 views

IDA doesn't see code

I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
106 views

Resource Hacker and IDA PRO

How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH). e.g. I find, in RH the following Menu items: POPUP "Painter" { MENUITEM "Start/Continue", 32840 ...
3
votes
1answer
59 views

Load .IDL / TypeLib into Ida Pro

I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool). Is there a way to load the ...
1
vote
1answer
74 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
110 views

IDA PRO - .id0: b Tree error: file open error: permission denied

Many times after closing a file I am working on and trying to open it later I get an error: <fileName>id0: bTree error: file open error: Permission denied even when i copy this file to a new ...