Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,932
questions
0
votes
2
answers
44
views
What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?
How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other.
Based on asking others ...
- 125
0
votes
1
answer
34
views
How can I use cutter like ida, trying to search by address
I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
2
votes
0
answers
49
views
Load to Ida binary with all of SO
I have a Linux ARM binary with a lot of shared libraries.
Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
- 51
-1
votes
1
answer
89
views
How to call and what means: _DWORD *__thiscall
I have one question maybe you can help, I always find this functions in IDA:
void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4)
And I use them like this:
// talkChannel
typedef DWORD(...
- 31
1
vote
0
answers
24
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
-1
votes
0
answers
244
views
What does this lowlevel function do?
I am currently reversing a game called Warframe and have gotten quite far.
There is just one function which is really making me wanna give up.
One hint I can give: The function was found IN another ...
- 1
0
votes
0
answers
22
views
Restore debug symbol for a embedded .bin image with an .axf file
I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device.
The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
- 3
-1
votes
0
answers
29
views
ida pro overwrite bytes not increase rom location (Value)
I am using IDA pro and try to edit hex code but when try to edit then it's overwrite the hex code not adding new code. In my IDA pro edit patch already enable but still overwrite and old hex code ...
0
votes
0
answers
28
views
How can IDA Pro disassemble paged memory from HCS12 processort?
I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory?
If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
- 11
1
vote
1
answer
39
views
How to define an xmmword variable in IDA?
How to define an xmmword variable in IDA?
IDA identified one variable as xmmword but I can't find a menu to define other variables around it as xmmwords:
I also tried to set the type after pressing ...
- 206
1
vote
0
answers
27
views
In IDA is there a way to load the PE headers after the initial loading?
This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it.
But suppose I have already worked on an IDB for a while and realize that ...
- 10.5k
1
vote
0
answers
25
views
Warning: struct->til conversion failed
In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code.
So I created a struct from the selection (Create struct from ...
- 10.5k
1
vote
1
answer
100
views
x86 - How do I detect virtualized code by looking at the assembly?
How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
- 39
1
vote
1
answer
77
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
0
votes
2
answers
55
views
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
In IDA, I have the following disassembly code (from an old 16-bit DOS application) :
les bx, _Foo
mov word ptr es:[bx+84h], 0FFFFh
mov word ptr es:[bx+8Ch], 0FFFFh
mov word ptr es:[bx+...
- 331
1
vote
1
answer
56
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
- 1,427
0
votes
1
answer
23
views
Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?
As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
- 115
0
votes
1
answer
24
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 101
0
votes
0
answers
60
views
reversed DOS game uncompression code: is that maybe a known compression method (RLE,...) or self-invented?
crossposted from stackoverflow - but i think stackexchange is better suited for such questions
History:
im currently working on reversing the game loader of the 1990 DOS game Alpha Waves
Youtube
i've ...
- 251
1
vote
0
answers
26
views
Why Qiling doesn't recognize the right EntryPoint?
I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point.
Here is the Entry-Point in IDA and in ...
- 83
1
vote
1
answer
29
views
How to rename the text of grouped nodes after creating them in IDA?
After I group nodes in IDA in the Graph View and name them, I can't change the name. I tried Edit group text button:
And Rename button:
I also tried anterior, posterior, normal comment and ...
- 206
0
votes
0
answers
31
views
how open .dmp file x64 in ida pro
how open dump file (proccess x64) in ida pro?
ida.cfg
DBGTOOLS = "C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\";
DBGTOOLS = "C:\Windows\System32\"
- 21
0
votes
1
answer
66
views
Decompilers points to non-existing virtual function
As part of solving the Hidden password challenge, I found an condition calls a virtual function
the v14 points to v8 variable :
and the functions in the program does not make sense for me, there is ...
- 5
0
votes
1
answer
55
views
Z3 is unable to predict the operand
When I try to solve this crackme chall (https://crackmes.one/crackme/61ffb07c33c5d46c8bcbfc1d) , there is a condition that I can't bypass and my z3 script can't predict the input string that will ...
- 5
0
votes
1
answer
38
views
How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?
TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc).
In order to explicitly load a type library I can use ...
- 10.5k
0
votes
0
answers
34
views
Is it possible to copy a video game and edit the copied version?
Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
0
votes
1
answer
43
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
1
vote
2
answers
80
views
IDA Free: How to patch a memory address
I have a disassembly line showing:
lea rcx, Format
In which Format is a memory address named by IDA. The address is at 0x1400132E0 and points to a C-String "hello, my dear\n".
What I want ...
0
votes
0
answers
23
views
Better debug output with IDA
I don't have much knowledge and experience with assembly so I value more or less readable IDA's pseudocode output. I want to examine stack and locals of the specific functions I set breakpoint in, ...
- 33
0
votes
1
answer
77
views
idapython: how to get decompiler output corresponding to the indirect call
For, e.g. disassembler or IDA view:
Decompiler or Hex View:
I can get the decompilation of whole function using something like:
decompiled = ida_hexrays.decompile(ea)
But, in this way I get the ...
- 1,427
0
votes
1
answer
58
views
Best way to monitor the access to a DLL of a software?
I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module.
Now I'm trying to find out how ...
1
vote
1
answer
88
views
In IDA, what does the number of underscores prefixing a function name mean?
In IDA, in the Functions subview, many functions have one or more underscores in their name. I'm guessing the number of underscores implies something. Does anyone know what the number of underscores ...
- 21
1
vote
1
answer
58
views
IDA pro and compiler-optimized 1-based array accesses in structure
I know title isn't very clear so here is an example of a code I'm trying to disassemble:
struct Inner {
int field1;
int field2;
};
struct Outer {
int some_data[16];
struct Inner the_array[16];
...
- 111
0
votes
1
answer
134
views
What is xmmword in IDA Pro?
Probably a silly question.
What's the xmmword means in IDA Pro?
1
vote
1
answer
56
views
Ida cannot open. a files of esp32 (Xtensa)
I tried to open this file with IDA Pro
https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a
Ida detect that is ELF for Xtensa (relocatable)
But when I tired to open it I got
Undefined ...
- 51
0
votes
1
answer
85
views
IDA - What LOC means in assembly?
I have this piece of assembly:
.text:0041B322 xor eax, eax
.text:0041B324 mov al, byte ptr [ebp+v13]
.text:0041B327 cmp eax, 1
.text:0041B32A jz loc_41B37D
.text:0041B330 xor eax, ...
- 135
1
vote
1
answer
145
views
Find DllMain using IDA Freeware
I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
1
vote
1
answer
41
views
How to have arrays in IDA's IDC
So to cut straight to the chase - I'm lazy, IDA is mysterious, I need to use IDA arrays in
my IDC code for convenience. Because IDC is like C(++) in its syntax I figured I could do:
auto lala[4] = {0,...
- 115
0
votes
1
answer
106
views
Why does IDA not show certain library functions in the function list?
This is very confusing and problematic. For example, in a certain executable, the winsock2 library is imported, but only CERTAIN functions from it are listed in the functions tab. However, they are ...
- 115
0
votes
0
answers
34
views
How to see where the heap is in IDA and how to see the segments for a process using non-source debugging
As in the title. I may be wrong about this but when using non-source debugging, all data coming from outside the source seems to be named debugxxx in the segments tab. .Rodata should be marked as ...
- 115
0
votes
1
answer
79
views
What's DD ? In IDA Pro
I'm new to reverse engineering with IDA.
If dd is short for data, double-word, is a 32-bit value. It shows ?
How do I identify the value stored in dword_140007674?
- 1
0
votes
1
answer
66
views
How do I enable Python on IDA 6.8?
I have a python dir within IDA 6.8 folder with idaapi.py, idautils.py, and idc.py. IDA doesn't seem to pick the Python scripting by default.
How do I enable it?
- 146
1
vote
1
answer
53
views
Custom IDA Decompilation Coloring
Is there a way to customize the coloring of IDA's decompiled code?
IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
- 113
1
vote
1
answer
92
views
How to print disassembly code with IDAPython when IDA doesn’t detect it as code
I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA:
I want to print ...
- 11
1
vote
1
answer
77
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....
- 373
1
vote
1
answer
133
views
Is there a way to install Python 3 modules into IDAPython with pip?
I would like to use regular python packages in my IDAPython scripts, but I can't figure out how to install them into IDA's Python environment. I don't even know where this python environment is, or ...
- 143
1
vote
1
answer
71
views
Find all references of a function in a program
I was wondering if there is a way to search all references/usages of a function in IDA without having to the run the binary?
I.e I would like to know all the places PathFindFileNameW function is ...
- 11
1
vote
1
answer
32
views
ApplyPatches to input file via IDC
Anybody know, how via IDC scripts applying patching for input file (i mean context menu: "Edit - Patch program - Apply patches to input file"). I viewed entire idc.idc and didn't see desired ...
0
votes
1
answer
130
views
IDAPython - How can I read the value of a function argument? (IDA 7.6)
I'm trying to automate some of my debugging with a python script that automatically places breakpoints at the first and last instructions of the functions I want to analyze. I'm using the breakpoint's ...
- 143
0
votes
1
answer
170
views
How to find function calls in IDA Pro?
I'm analyzing some *.DLL, I found a function such as sub_10151561 () and I would like to know which other functions call this function.
How to do it?
Thank you in advance.
- 1