Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,831
questions
0
votes
0answers
12 views
How to force IDA to analyze a function immediately?
I think my question is probably related to this one:
API to force reanalyze of function (Alt-P)
When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
0
votes
0answers
13 views
ida pro: dwarf fatal error; the dwarf plugin will stop now
I recently observed this bug (error), when I upgraded gcc/g++ from version 9.x to 11.x.
Basically, Ida fails to parse debug information. I don't get this error when I compile with gcc 9.x. Note that, ...
0
votes
0answers
15 views
Can't find references (xref) to function
I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA.
Is there a plug-in or something that I ...
1
vote
0answers
19 views
Does COT_HELPER have arguments/operands?
I am trying to learn the hexrays ctree api. I am using the python bindings.
The task I am trying to automate is tracing the arguments to wrmsr instructions.
I notice that hexrays represents them like ...
1
vote
1answer
137 views
Why address space is different for Ghidra, IDA and xDebug runtime and which one to use?
I have opened an executable with Ghidra, IDA and x64dbg (runtime).
It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra.
When hooking through ...
2
votes
0answers
36 views
How do relocations work for imported functions in SH4 ELF?
I build very simple hello world code with sh4 gcc compiler as shared library:
#include <stdio.h>
void hello()
{
printf("Hello world!\n");
}
But when I load .so file into the ...
0
votes
1answer
27 views
ARM floating point register S0 used without initialization
The following code snippet is the first few assembly instructions of a function.
The code runs on armv8a.
SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
0
votes
1answer
39 views
Creating table with IDAPython
I'd like to create the table like below, I could not found any clue while googling it.
Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class?
Any advises would ...
1
vote
0answers
71 views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
1
vote
1answer
63 views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
0
votes
1answer
52 views
How to load a pdb file from the hard drive with IDA Pro?
All the answers I see on Google are about how to load PDB files from online servers. But I have an exe I'm debugging. It's my own exe. Only reason I want to debug it, is so that I can step through ...
0
votes
0answers
36 views
Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step
I'm new to remote debugging so plz bare with me.
I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
0
votes
0answers
26 views
IDA + Windbg does not break on sxe commands
I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
0
votes
1answer
53 views
What is most likely the reason causing this problem?
I'm trying to reverse engineering a obfuscated game, and when I import this related .so file into IDA, it output this :
What technique is most likely been used in achieving such obfuscation ?
0
votes
0answers
49 views
Ida pro doesn't demangle all function names
I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are symbols in the firmware and I know function names but Ida didn't manage to demangle all function ...
1
vote
0answers
30 views
How to print a manually defined struct in IDA pro while debugging?
Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members.
Now if i have the variables'...
0
votes
2answers
51 views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
0answers
20 views
How to extract an AutoIT script when tools fail to extract it?
Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it.
What would you do? is there any place in ...
0
votes
1answer
18 views
How to convert string to a variable in IDA
I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references:
How can I do it? I am not sure what to choose here:
0
votes
1answer
82 views
IDA PRO decompiler expression last question (pseudocode)
memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19);
.....
shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory;
.....
shellcode(&hkernel32, 0)
If ...
0
votes
1answer
29 views
Undo step with IdaPython?
With Ida I can press Control+Z to undo the last action
Can I do that with IdaPython?
0
votes
0answers
58 views
IDAPython: error executing init.py:
When I open Ida Pro 7.3 I see an error message
IDAPython: error executing init.py:
nothing to repeat
Refer to the message window to see the full error log.
How can I understand what is the problem? ...
0
votes
0answers
27 views
Get first and last address of binary with IdaPython
How can I get the first and last address of binary with IdaPython?
0
votes
1answer
63 views
Add python to Ida Pro 7.3
I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script.
How can I add Python to Ida , So I can run Python script via IDA ?
0
votes
1answer
164 views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
1
vote
2answers
135 views
How to debug / analyze a Themida protected binary
Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation:
STACK_TEXT:
03799f54 00f91cfa 24d1ae78 0000000f ...
1
vote
1answer
138 views
IDA Pro shows an array where two varaibles should be
I'm working in a Delphi binary and found a little issue while generating pseudocode.
This is the output (after some clean up) that IDA gives me:
Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
0
votes
0answers
14 views
IDA doesn't create Elf32_Sym struct and thus no export for shared object dumped using Frida
I am reverse engineering a program which decrypts encrypted .so file runtime. It seems like they encrypt-decrypt only partially, because the decrypted file and encrypted file matches up to 0x4893D07. ...
0
votes
0answers
15 views
IDA PRO changing Assembly instructions to redirect end of function
I have a piece of malware and in one of its functions there is a switch statement. At one of the branches instead of jumping to a specified location it is ending the function resulting in a "sp-...
0
votes
0answers
42 views
viewing debugging symbols in windbg
I am currently learning Malware Analysis using the book "Practical Malware Analysis", and I am going along with the chapter on Kernel debugging.
When viewing the same code snippet on WinDbg ...
2
votes
2answers
116 views
IDA PRO Hex-Rays try-catch
I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice.
I've been searching and it seems like IDA does not support them so I was wondering if there is ...
0
votes
1answer
35 views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
3
votes
0answers
42 views
Cannot load pdb in IDA Free 7.6
I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach.
I have just installed the last version of free IDA (7.6) ...
1
vote
2answers
76 views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1answer
62 views
IDA Pro 7.5 Breakpoint Python Script: 'invalid non-printable character U+FEFF'
I'm trying to set a python condition breakpoint, but it throws me a weird error and I don't understand what happens:
Even if I just return True, it throws the same error when I compile or when press &...
1
vote
0answers
45 views
IDA Pro don't understand address extension register in HC16
Source:
ROM:13A2 006 ldab #0Fh ; Load B
ROM:13A4 006 ldx #0FA27h ; Load IX
ROM:13A8 006 tbxk ; Transfer B ...
1
vote
0answers
28 views
Passing a pointer to a pointer to a string with IDA Pro's Appcall
I need to call an encryption function in a program with the following signature (the second argument is returned):
char** __usercall decode(char** input, char** output)
As far as I can tell, Appcall ...
-1
votes
1answer
51 views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
2
votes
1answer
101 views
How to analyze dumped process?
I'm trying to reverse engineer a malware which uses a Process Hollow technique. This malware uses an API hashing technique and contains some RC4 encryption algorithm references.
I already knew the ...
0
votes
1answer
48 views
IDA Pro Debbuger is debugging the original code and not the patched code
Using IDA Pro, I tried to patch int 2Dh to nop.
However, with the debugger, it seems that the original code is being loaded.
What may be the reason for that? This might be related for some protections?...
0
votes
0answers
25 views
How to replace the modified/corrupted module image on the original in the memory dump
I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
1
vote
0answers
52 views
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:
jnb short near ptr loc_1C61B1+3
It order to do this I'm running a snippet like this in a script:
ida_bytes.del_value(...
0
votes
0answers
46 views
Reconstructing "relative" import functions in IDA
Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed.
I'm reverse engineering a packed win32 executable, so I ...
0
votes
0answers
30 views
Indirect calls using registers (IDA)
I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
0
votes
0answers
74 views
IDA: Function arguments detection
I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. ...
2
votes
1answer
64 views
How to know when a subroutine starts when reversing an ARM64 file?
I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
1
vote
1answer
43 views
Display open handles in IDA pro, just like xdbg?
I want to know for example that if a ReadFile is happening and the handle number is 100, which file or whatever this handle belongs to?
lets assume for whatever reason i cannot trace CreateFiles to ...
1
vote
0answers
95 views
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
0
votes
0answers
40 views
Basic Block generated by IDAPython code are different compared to BN generated output file
I have a query regarding different BB count using two different tools.
I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to ...
1
vote
0answers
26 views
How to move function names, comments, local variable names and structs to a database for a new version of the executable?
I have reversed a number of functions and added definitions for some structs in an Intel x64 PE executable. A program got an update. I moved old executable with the old database into another folder ...
