Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
0
votes
0answers
39 views
I want to hire IDA Pro / Hex Ray Reverse Engineer [on hold]
I want to hire IDA Pro / Hex Ray Reverse Engineer for some projects within the car industry. Can anyone point me in the right direction.
0
votes
1answer
24 views
How to see all of my changes in idb?
Is there ant way to see all of my changes in idb file ?
All of variable in psudo code that I changed here name, all the funxtion I rename.
I want to see all of this
0
votes
0answers
56 views
IDA Pro debugging Linux .so libs
I am trying to debug a library that a server application loads in.
On an Ubuntu server I start a gdbserver like this:
gdbserver localhost:23946 ./smallserver
After this on my Windows, I load the ...
1
vote
2answers
29 views
IdaPython Get Call Destination for Register Operand
I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of ...
3
votes
1answer
101 views
Point-to analysis of IDA Pro
I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.
According to my personal ...
3
votes
1answer
35 views
Importance of Compiler Version in generating a signature
I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake.
I then use the signature file (in the appropriate IDA Pro ...
1
vote
0answers
54 views
Need help understanding IDA Pro pseudocode
I am new into IDA and have some questions about the pseudocode in C.
Could someone please explain to me the meaning of the following two lines:
(*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
-1
votes
1answer
69 views
Analyze raw assembly using IDA Pro
I have a raw assembly dump i.e.
.intel_syntax noprefix
.bits 32
.global main
main:
push ebp
...
And I know it's Intel x86 and the original function was most likely written in C. Now the ...
0
votes
0answers
37 views
How to get index register from the instruction in IDA?
I have the instruction:
add edx, ds:dword_7BFC7A50[eax*4]
i.e.
add edx, [eax*4+7BFC7A50h]
And I decode it via decode_insn(). Then I try to get the information about the second operand. I ...
1
vote
0answers
26 views
IDAPython: Get the operand string without any substitutions [duplicate]
I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset ...
1
vote
3answers
56 views
IDA Debug DLL with non exported function
I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that?
Thanks so much./
4
votes
1answer
79 views
Need help identifying main processor for Roland synthesizer
I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro.
So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
0
votes
1answer
29 views
How to convert IDA Pseudo code casts to Array
I have a pseudo code in IDA which is as such
consdering v5= 3838385024767399985LL
v1 += 53 * *((char *)&v5 + i);
In C-Friendly format this should be
v1 += 53 * v5[i]
Is there any way in IDA ...
-1
votes
0answers
26 views
IDA unable to resolve local var
I'm decompiling a function and as you can see I've finished most of the parts, yet still left some annoying v1 - 0x1D4 unsolved. Here v1 is EBP, so these annoying stuff must be local vars. Then why ...
1
vote
2answers
50 views
.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?
I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
3
votes
2answers
278 views
Move twice, from and to the same location
I'm trying to reverse a function and I came across these lines inside the function:
1. call ds:HeapAlloc
2. mov [ebp+var_4], eax
3. mov eax, [ebp+var_4]
Why is line 3 needed? If I need to ...
0
votes
0answers
57 views
IDA - Find Function via Arguments
I am looking for a specific function. I have the header file of the Target, thus the function declaration. IDA seems to know the Arguments passed to a function, so how can I match the Arguments in the ...
0
votes
0answers
24 views
Compare / highlight differences between 2 .dll files [duplicate]
so I have 2 .dlls and I was thinking if it's possible to easily compare/highlight the things that are different between the two with IDA or anything else you have in mind that could make that job ...
1
vote
1answer
77 views
How to find out all the locations that call an external function using ida pro?
I just want to find out all the locations that call the standard library function pthread_attr_getstack using ida pro. There is an entry in .plt:
.plt:00015894 ; =============== S U B R O U T I N E ...
1
vote
1answer
49 views
Remove Binary from IDA Database
I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
1
vote
1answer
49 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
3
votes
1answer
68 views
Find MFC class memory layout automatically in IDA?
Background
I was using IDA to reverse engineer an DLL which uses MFC100.
I was reading Reversing an MFC application: How to find class memory layouts? and https://stackoverflow.com/questions/...
0
votes
0answers
34 views
How to find first/next instruction in IDA trace via IDC
Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...
0
votes
0answers
13 views
IDC - How to apply type - ApplyType?
How do I apply a type to function - no-matter what input I always get 0.
Here is my script:
//
// This example shows how to get list of functions.
//
#include <idc.idc>
static main() {
...
0
votes
0answers
51 views
How to change value in IDA pseudocode?
If I press F5in ida, I can see pseudocode.
When I debug this pseudocode, I can see values of variables.
How can I change the value of specific variable in pseudocode?
0
votes
0answers
45 views
Autor-resolve enumeration members?
How to make IDA auto-resolve integer constants into enumeration members when they are being used in a call?
I've tried setting appropriate function types and then reanalysing the program but alias ...
2
votes
1answer
110 views
Why having a function with just one instruction
I decompiled a program where there is a function, which has only a single useful instruction which is
xor eax, eax
retn
What it the purpose of having this in an extra function, instead of using xor ...
4
votes
1answer
71 views
How to get execution time of IDC script?
As a beginner I'm trying to disassemble a file with IDA Pro 6.8. I write some IDC script for time-consuming work.
Now, I want to get the execution time of my script, but I can not find appropriate ...
1
vote
1answer
44 views
find a dialog in ida using resource hacker
I am having difficulties finding the dialog reference in IDA.
e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this:
5035 DIALOG 0, 0, 295, 163
STYLE DS_SETFONT | ...
1
vote
2answers
62 views
Monitor all changes done by function
What is the easiest way to track all changes before and after a specific function is executed.
I know I can trace instruction but that may yield a long list of all command executed.
I want to stop the ...
0
votes
1answer
33 views
IDAPython Script works from “Script File” but not when run with -S from Terminal
I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
1
vote
1answer
39 views
IDA plugin to view hex bytes similar to objdump
Is there a plugin or option in IDA that interleavs the hex bytes for
each instruction similar to the output of objdump? I.e. like this:
1800035f1: ff 15 19 5a 00 00 callq *0x5a19(%rip) ...
0
votes
1answer
57 views
IDA PRO - compare running process
I have a software which writes some data to specific location in memory depending on user choices.
Say i can have 2 choices, A & B.
I want to run IDA, set option A and save all the data, then run ...
0
votes
1answer
56 views
Understand hardware breakPoint option in ida
When I set a hardware breakpoint I see the following dialog:
I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written.
I ...
3
votes
1answer
54 views
Why IDA define negative offset?
a = byte ptr -19h
Why offset from stack base can be a negative number ? Can anyone explain this for me please?
1
vote
1answer
56 views
How to set hardware breakpoint by value?
I want to set in IDA breakpoint when a specific value is written on the stack.
I know how to set hardware breakpoint, but I can set it only by address.
0
votes
4answers
244 views
Older versions of IDA free?
I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither.
Does ...
0
votes
0answers
33 views
IDA PRO - Database changes after some test
I noticed that after some debugging my database has many remarks and some changes which were not there during the initial analysis nor after the firs few debugging sessions.
e.g. i see this is how to ...
0
votes
1answer
33 views
immediate value change when start debugging
I patch the code for my work. I have a problem with code patching.
I use IDA pro 6.8.
I added code like this.
(Assembly) (Hex dump)
mov eax, 638BACh --> B8 AC 8B 63 00
Not problem ...
2
votes
1answer
70 views
Batch rename functions knowing their prototypes in IDA Pro
I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
1
vote
1answer
99 views
How to find V-Table in IDA? (Using class informer)
I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do).
But how do i find them in IDA? I'...
2
votes
1answer
41 views
IDAPython Code <-> Data
I'm looking for a way, to make programmatically change of data type. This is the same as you press 'C' or 'D'.
For example convert this:
.text:00401008 unk_401008 db 55h ; U ; ...
2
votes
2answers
110 views
IDA PRO run patched program from debugger without creating new exe
Using IDA PRO, after making a few patched, can I run the patched program in the debugger?
What I have been doing so far is:
1. Edit > Patch Program > Apply patch to input file…
2. Save in a specific ...
-3
votes
1answer
48 views
Change value of an IF condition found in IDA
so I have the .idb file of an executeable I want to modify.
In the IDB file, I found this code
And I basically want to change 4111006 to 1006 in that IF condition.
however, when I press TAB to go to ...
1
vote
1answer
88 views
IDA PRO “try{” comment
2 related questions:
I noticed that in some of the blocks in the graph there are more branches that I would expect.
These are not jump tables yes I see, e.g. 3 possible branches.
How come?
The 2nd ...
0
votes
0answers
57 views
IDA doesn't see code
I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
106 views
Resource Hacker and IDA PRO
How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH).
e.g. I find, in RH the following Menu items:
POPUP "Painter"
{
MENUITEM "Start/Continue", 32840
...
3
votes
1answer
59 views
Load .IDL / TypeLib into Ida Pro
I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool).
Is there a way to load the ...
1
vote
1answer
74 views
What is ObjectStublessClientXX in ole32dll?
When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll .
What is that function? What does it do?
Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
110 views
IDA PRO - .id0: b Tree error: file open error: permission denied
Many times after closing a file I am working on and trying to open it later I get an error:
<fileName>id0: bTree error: file open error: Permission denied
even when i copy this file to a new ...
