Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,957
questions
0
votes
1
answer
24
views
Using IDA pro decompiler in Ghidra
Is it possible to use IDA pro decompiler in Ghidra ?
I know the opposite is possible.
- 1
0
votes
1
answer
34
views
My IDA have 2 different address for same code How to change it
I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
- 1
1
vote
1
answer
48
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
1
vote
0
answers
50
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 21
0
votes
0
answers
30
views
How to extract byte arrays? [closed]
I have .bin file from Counter-Strike: Global Offensive game. How can I extract byte arrays from this file?
Download link to file
(File size:10.8 MB)
0
votes
1
answer
37
views
Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header
I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum.
file output:
libTheArmKing.so: ELF ...
- 177
2
votes
1
answer
58
views
Decompilation output modification in IDA Pro
I am trying to modify cfunc AST from
If (a1 && some_func_ptr) {
some_func_ptr();
}
To
if (a1) {
some_func_ptr();
}
But I constantly get INTERR 50683 error. I tried
new_item = idaapi....
- 71
1
vote
0
answers
34
views
How can I enumerate and hook all non-exported functions in lib.so using frida?
I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
- 219
1
vote
1
answer
45
views
Automatically name class methods in IDA
Let's say I have:
mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function
Is there a feature/plugin/script to automatically rename all subroutine occurrences to:
mov ecx, [...
0
votes
0
answers
14
views
IDA debug function spawned by pthread_once
I am using IDA to debug android, some libs use pthread_once/pthread_create function to call a function. How do I use/set up IDA to debug the function passed to pthread_once ?
- 29
1
vote
0
answers
38
views
Wrong EP on an .elf CrackMe
I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
- 11
0
votes
0
answers
34
views
What is the most effective tool to analyze apk file
I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes.
However, I am facing an issue for ...
- 1
1
vote
0
answers
60
views
Ida Pro can't decompile big function
I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error :
The graph is too big (more than 1000 nodes) to be displayed on the screen.
Switching to text mode.
(you ...
- 183
0
votes
1
answer
62
views
How to import Ghidra DB into IDA?
I see many questions about how to import IDA DB into Ghidra but I interesting in the backside. I want to export Ghidra DB and import it into Ida PRO. How I can do that?
- 39
0
votes
0
answers
30
views
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:
.text:00488DA0 ; =============== S U B R O U T I N E ==========================...
- 199
0
votes
1
answer
77
views
How to speed up finding a function from pseudocode in IDA?
I have a function with the pseudocode of
__int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3)
{
if ( qword_7FF709F91498 )
return (*(__int64 (__fastcall **)(ID2D1Geometry *...
- 39
3
votes
2
answers
299
views
Where does IDA load binary in Ida64.exe process?
I quickly checked the address range shown in IDA within the ida64.exe process using a kernel debugger, and the memory is question marks, indeed there is no VAD allocation for the range.
I don't want ...
- 235
0
votes
0
answers
31
views
Is there any reason to define a struct instead of a local type in IDA pro?
It seems to me that there is no reason whatsoever to define an asm-style struct rather than a C-style type. A C-style struct type can contain references to floats and doubles, user defined types, and ...
1
vote
1
answer
50
views
Static Code Analysis of a C166 function
I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
- 51
0
votes
2
answers
64
views
Renaming a local stack variable with IDAPython
I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so...
In my ...
1
vote
1
answer
67
views
What is j__ftol2_sse_excpt in IDA?
I was inspecting the c-pseudocode for a PE executable in IDA.
I found some function called j__ftol2_sse_excpt()
When I open that function I see that the function is calling another function named ...
- 19
2
votes
1
answer
70
views
How to debug cfg80211.ko
I have an Linux embedded device that I want to debug the cfg80211.ko
I have full root SSH on that device.
How can I debug cfg80211.ko?
- 71
1
vote
1
answer
36
views
Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4
I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction:
from capstone import *
from capstone.x86 ...
- 1,446
1
vote
0
answers
28
views
IDA throws "Module <lib> has no names" error after attaching a remote process
I am using IDA for debugging a remote process. After set IDA_LIBC_PATH to a correct libc.so in my android device to resolve IDA multi thread problems, I cannot get a list of export functions of ...
- 29
0
votes
0
answers
31
views
Convert IDA imagebase to detours
I have succefully hooked a game with imagebase 400000 (Ex:
// LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4)
Game.SecondaryFunctHookAddress = "0x2D5040"
and the ...
- 199
1
vote
0
answers
48
views
How to solve bad pseudocode format of Hex-Rays Decompiler?
Look at the following pseudocode:
void *__cdecl func(const char *a1, int a2, void *a3)
{
_DWORD *v3; // esi
int v5; // ebp
int v6; // eax
void *v7; // esi
_DWORD *v8; // eax
int v9; // edx
...
- 129
1
vote
0
answers
32
views
IDA how to remove all uses of a type?
I'm editing an exe which has a function that is used in multiple places with completely different meanings for the return type (a getter that wasn't inlined). I had assigned it a return type to make ...
- 73
2
votes
0
answers
36
views
Disable IDA Downloading Symbols Automatically
How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.
- 29
0
votes
0
answers
53
views
Rebasing program
When I start debug in IDA, it's appears small window "Please wait... Rebasing program", and it's take about 3 minutes. Is it possible eliminate this process named Rebasing program? It take ...
- 113
0
votes
0
answers
72
views
How to byte patch a longer hex/byte from the original?
I am fairly new to IDA PRO I hope this is not some kind of stupid question but please bare with me. How do you change patch a hex/byte that is longer than the original?
Example:
When I try to byte ...
0
votes
1
answer
67
views
What is libm_sse2_sin_precise() and how to find it's parameters in IDA?
I'm new to reverse engineering with IDA.
I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable.
I tried clicking that function but the executable requires the DLLs.
...
- 1
0
votes
1
answer
105
views
How can I override a x86 instruction in c++?
I am trying to replace a jmp instruction with a ret in c++. How can I do that?
- 11
0
votes
0
answers
39
views
Handling stack strings in IDA, but with a twist (wchar_t-based, not char-based)
Consider the following disassembly:
mov dword ptr [rbp+430h+var_458], 690068h ; L'i' + L'h'
mov dword ptr [rbp+430h+var_458+4], 2E0064h ; L'.' + L'd'
mov dword ptr [rbp+430h+var_458+8], ...
- 10.5k
0
votes
1
answer
27
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 21
4
votes
1
answer
91
views
Can I get back an exe file from an .Asm formatted file disassembled with IDA?
I actually have a .asm formatted file. This file was certainly obtained by disassembling an original exe file with IDA and then save as an .asm file. Now I have this .asm and I would like to get back ...
0
votes
2
answers
99
views
What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?
How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other.
Based on asking others ...
- 125
0
votes
1
answer
90
views
How can I use cutter like ida, trying to search by address
I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
2
votes
1
answer
127
views
Load to Ida binary with all of SO
I have a Linux ARM binary with a lot of shared libraries.
Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
- 71
-1
votes
1
answer
155
views
How to call and what means: _DWORD *__thiscall
I have one question maybe you can help, I always find this functions in IDA:
void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4)
And I use them like this:
// talkChannel
typedef DWORD(...
- 131
1
vote
0
answers
31
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
0
votes
0
answers
31
views
Restore debug symbol for a embedded .bin image with an .axf file
I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device.
The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
- 3
0
votes
0
answers
43
views
How can IDA Pro disassemble paged memory from HCS12 processort?
I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory?
If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
- 11
1
vote
1
answer
78
views
How to define an xmmword variable in IDA?
How to define an xmmword variable in IDA?
IDA identified one variable as xmmword but I can't find a menu to define other variables around it as xmmwords:
I also tried to set the type after pressing ...
- 206
1
vote
0
answers
35
views
In IDA is there a way to load the PE headers after the initial loading?
This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it.
But suppose I have already worked on an IDB for a while and realize that ...
- 10.5k
1
vote
0
answers
38
views
Warning: struct->til conversion failed
In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code.
So I created a struct from the selection (Create struct from ...
- 10.5k
2
votes
1
answer
134
views
x86 - How do I detect virtualized code by looking at the assembly?
How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
- 49
1
vote
1
answer
122
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
0
votes
2
answers
106
views
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
In IDA, I have the following disassembly code (from an old 16-bit DOS application) :
les bx, _Foo
mov word ptr es:[bx+84h], 0FFFFh
mov word ptr es:[bx+8Ch], 0FFFFh
mov word ptr es:[bx+...
- 341
1
vote
1
answer
82
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
- 1,447
0
votes
1
answer
44
views
Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?
As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
- 115