Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,773
questions
0
votes
0answers
7 views
IDA Pro - reverse Program while it's
So, I have a program where I can load scripts into the program when running it. Is there any way to see what is going there with the help of IDA? Because normally IDA debugs the whole program and goes ...
1
vote
1answer
17 views
Remote debugging android native lib(.so) No connection could be made because the target machine actively refused it. when connecting to
I have a running IDA debug-server on my virtual android device(check attachments).
The problem is: when I try hit Attach procces it gives me an error(check title).
Here is some kinda params that I'm ...
0
votes
0answers
14 views
IDA pro 7.5.2 fails to find python.dll even tho it is in the correct folder?
Anyone ever have this problem? how can it be fixed? Installed ida pro 7.5.2 the other day in the python folder it has two files named 2 and 3 clearly for python 2 or 3 but its not even finding the ...
1
vote
1answer
17 views
ida_hexrays.lvar_t.stk.get_stkoff() incorrect ± 0x10
When using the stack offset for a variable obtained via ida_hexrays.lvar_t.stk.get_stkoff() or ida_hexrays.vdloc_t.stkoff() the results vary between "correct", and 8 or 16 bytes out as ...
1
vote
0answers
35 views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
1
vote
0answers
22 views
How do I disassemble mips .o object files in ida elf 64bit
So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
0
votes
0answers
32 views
Unrecognized function
There is function:
push 65h
push edi
call sub_5D8750
In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
2
votes
1answer
51 views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
-2
votes
0answers
61 views
IDA Pro unable to disassemble the following function
I'm new to this forum recently I have been trying to learn how to reverse IPA. While decompiling an app, IDA would return this but would not be able to return meaningful data about this section.
...
0
votes
0answers
21 views
Can't figure out the type of hash
I know that SHA-1 is a cryptographic hash and it takes 20-byte and this is an example of it 64C1F7689B32D9805C5A1D5DABF3EAD31446B80C
The problem is with iirc,
I'm working in a small project, and ...
-1
votes
1answer
33 views
Finding some specific adresses in an exe file
I'm an absolutely beginner in the reverse engineering field.
I've an exe program and I should find : address of main function/address of function that validate user input/address of hardcoded password....
0
votes
1answer
69 views
How do I find missing/undefined vtable functions in IDA64?
I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them?
(*(BaseClient->int640 + 304))(...
-2
votes
0answers
24 views
MS-DOS 16 bit Autonet.exe [closed]
I have downloaded Autonet neural network program from https://archive.org/details/msdos_AUTONET_shareware.
This is a a demo program with limitations and there is no full version available. Can ...
3
votes
1answer
50 views
Force IDA to reanalyze a function recursively?
How can i force IDA to re analyze a function recursively (meaning including every function inside of it and so on) and recognize all the functions inside of all the functions? because right now when a ...
0
votes
0answers
19 views
Decompiler view of IDA pro when debugging windows kernel shows the content of every variable as “?”?
When Im debugging windows kernel using IDA pro and i am using the decompiler, it does not show the content of ANY variable, when i hover the mouse to any variable, it just says "?" ??
how to ...
1
vote
0answers
15 views
How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?
Lets say there is a variable x in f1, and f1 calls f2 with the variable x
I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
0
votes
2answers
45 views
Import header files in IDA to get the struct definitions?
I am reversing a program that has a lot of internal structs in it.
The problem is that there are a lot of structs, so i can't import them manually using local types->insert.
Lets say i have some ...
-1
votes
0answers
48 views
Export / Convert Ghidra database (GZF) to IDA database (IDB)
I am deeply frustrated after spending the last days searching for a way to do what the title of the question says, but all I could find was IDA database -> Ghidra database conversions.
I have found ...
1
vote
1answer
40 views
Define partial struct with IDA
I want to define struct in Ida , but I know only partial of this struct
I only know that in arr[12] that int student_id , and I don't know the rest of struct. Ida recognize that struct as char * .
How ...
1
vote
1answer
33 views
Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?
I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
1
vote
1answer
57 views
Merging a large number of segments in IDA Pro
I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
2
votes
3answers
112 views
How can I view the output of printf calls without a console window?
I'm using IDA to poke around in an old video game and noticed there are lots of calls to the printf function:
I can see in another function that dword_5CE914 is a bitmask comprising various startup ...
0
votes
0answers
27 views
Can I find out what methods are being swizzled in runtime?
I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
-1
votes
0answers
23 views
How to use NtDeviceIoControlFile() function to send a keystroke?
I want to use NtDeviceIoControlFile() to send a keystroke but I don't know what arguments to pass.
1
vote
2answers
26 views
How to remove OFF64 SEGDEF from IDA disassembly
This has plagued me from IDA 6.5 to 7.5.
.text:0000000143EFE8CD CC db 0CCh ; Ì OFF64 SEGDEF [_text,140CFC35B]
It may not look like much, but when a conditional jump is placed over ...
0
votes
2answers
56 views
Finding function in IDA from x64dbg
I've found a function I want to call in x64dbg, and wanted to see it's prototype and how it looks like in IDA. However, I was expecting to see a function in IDA but land in the middle of one.
The ...
0
votes
1answer
47 views
IDA - How do I find every call to a sub
I'm using IDA to try and understand how a particular executable works. I've found the routine I'm interested in IDA Pro and it all makes perfect sense, in so much as I can see exactly the process play ...
0
votes
2answers
59 views
Is it possible to “jump” to another address when script detects jmp?
here is the original C++ source code of the executable that I've created to do simple RE
#include <iostream>
void myFunction() {
printf("Hello!");
}
int main()
{
myFunction()...
0
votes
0answers
26 views
Debugging kernel modul with IDA
I have shell at linux-arm-embedded and running gdb-server, There is kernel module(ko) that I want to debugging .
How can I do that with IDA ?
0
votes
2answers
40 views
How to get dynamically changing xrefs with IDAPython
There is a situation where the number of xrefs for a function is dynamically increasing due to the dynamic creation of memory with execution rights attached by VirtualAlloc. I want to get the xrefs of ...
0
votes
0answers
19 views
getting the content of the Thread Envoirment Block in IDA Pro
i have started out reverse engineering with IDA Pro a few weeks ago. Currently i am reversing a heavily obfuscated file which uses many anti-reversing techniques and in particular relys heavily on ...
0
votes
0answers
71 views
Where to start analyzing a 16 bit dos program?
I've tried to analyze this small exe online.
I've tried with https://onlinedisassembler.com/odaweb/ (link) but it's hard for me to get the first question:
Why the tool doesn't try to detect the set ...
0
votes
0answers
37 views
Editing assembly language to bypass the condition
I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
0
votes
0answers
26 views
how highlight multiple word in ida assembly view? (already know method in graph view, but dont work in text view)
like set different bg or fg for two keyword : eax and ecx (or hex )
not line highlight ....
in graph view , i found a plugin to do this by hook graph node text , but no search result for text mode ...
0
votes
1answer
33 views
How to show the save dialog box with IDAPython?
I want to some strings to the text-file which is chosen from the save dialog box.
Is there any way to show the save dialog box by IDApython and how to write the script code about that ?
0
votes
1answer
31 views
Is there any way to STOP the loop of the IDApython?
Is there any way to STOP the loop of the IDApython ?
I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
0
votes
0answers
52 views
IDA help me understand these operations on the memory
I have a stripped binary, which I want to reverse engineer. I spent quite some time with it, and dug myself through most of it, however, I got stuck near these lines.
Context: the program has 5 local ...
0
votes
1answer
64 views
(IDAPython)How to get the function name string from the Function address?
For example, in the Registers windows of IDA pro, It show the following.
( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.)
EAX 766D32B0 WS2_32.dll:...
0
votes
1answer
44 views
how to call the function from IDAPython with passing arguments by manually push them to the stack
would you please tell me how to call the function from IDAPython code ?
I want to simulate it by manually push to stack as the two arguments and calling the function.
0
votes
0answers
24 views
How to apply complete type information from PDB for multiple images in one IDA database?
IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top ...
0
votes
0answers
22 views
How do I debug Linux kernel modules with IDA?
I'm trying to figure out a workflow for analyzing Linux kernel modules.
I want to debug the modules and not just view the disassembly, so I came upon this guide for IDA pro:
https://www.hex-rays.com/...
1
vote
1answer
95 views
How to deal with IDA auto-analysis analyzing invalid paths?
Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis.
There is some mention of ...
0
votes
0answers
33 views
How to replace a segment with a single structure consisting of the data in that segment - programmatically?
So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then ...
0
votes
0answers
43 views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
0
votes
1answer
217 views
Modifying program using IDA/Hexrays decompilation pseudocode
A bit long-winded, apologies in advance. Updates to the question are at the end.
I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
1
vote
1answer
57 views
IDA SDK - can't understand the output of displacement query functions?
OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)):
//op is ...
1
vote
1answer
41 views
How to retrieve an `insn_t`?
So I was looking around the IDA SDK and I saw insn_t - it looked useful - any ideas how can I retrieve it - I wasn't able to find any function that returns it.
0
votes
1answer
60 views
IDA refuses to recognize basic block as part of function that jumps to it
I have a function MyFunc in an obfuscated program as follows:
Start address: .text:000000014219FC5D
End address: .text:000000014219FD0E
MyFunc starts off by jumping to .text:000000014143C159, which ...
0
votes
1answer
43 views
IDA Unknown Exception Code 6F4
So basically I had set a breakpoint on a WINAPI function call. When I tried to run the program and step over the breakpoint, the program exits with the popup window: unknown exception code 6F4 (exc....
0
votes
1answer
29 views
Which processor do I specify when I load HCS08 firmware to IDA?
Motorola/Freescale MC680xx, CPU32 (68330), MC6301, MC6303, MC6800,
MC6801, MC6803, MC6805, MC6808, HCS08, MC6809, MC6811, M68H12C,
ColdFire
IDA claims to have the support for HCS08. But I can't see ...
