Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,519
questions
0
votes
0answers
28 views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
0answers
9 views
syscall without saving values in the correct registers
I'm RE a challange of pwnable.tw (dobblesort) and I found some strange things while disassembling the file.
My Question is about the syscalls that are done.
Why they don't save the value in the ...
0
votes
0answers
3 views
compile gdb with python 3 for gef-ida-interact
I'm trying to use GEF's IDA-interact which has issues with python2.
I'm using android-ndk-r20b/prebuilt/linux-x86_64/bin/gdb - v7.11 using Python engine 2.7
How do I compile gdb with python 3.x ?
I ...
1
vote
0answers
24 views
Names not populating from disassembly to decompiler
I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation.
I have never noticed this ...
0
votes
0answers
18 views
Decrypting Lua Files from apk
similar question Decrypting Lua Files
the code has been changed.
this the pseudocode from LIBCOCOS2DLUA.SO >> cocos2d::FileUtilsAndroid::getData
https://pastebin.com/L35Vsdyn
i've search and ...
1
vote
1answer
23 views
How to find the new address of a function on a new version of the same assembly with IDA?
Well, I have the old version of an assembly with a mapped address to a function I need to detour.
The developer has stopped the reverse engineering to that assembly, so now, I want to do his job. But ...
0
votes
0answers
10 views
Disassembly Memory Organization parameters for C166 micro firmware (RAM and ROM section)?
I'm trying to disassemble some microprocessor firmware with C166 architecture in IDA, but I have no idea what to use for the memory organization screen (IGNORE THE VALUES IN ROM/LOADING SIZE)
My ...
0
votes
1answer
29 views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
0
votes
0answers
12 views
Using Gdb-Server with Ida 7.4 failed
I have gdb-server to arm , downloded from https://github.com/therealsaumil/static-arm-bins/blob/master/gdbserver-armel-static-8.0.1.
When I use Ida 6.6 to connect remotly to this gdb-server that work ...
1
vote
0answers
36 views
Using Python 3.7 and 2.x in same IDA
I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.
Is there any way to run that Python 2.7 based plugin?
0
votes
0answers
45 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
0
votes
0answers
29 views
IDA plugin handles signal only on hotkey press
IDA plugin handles signal only when I click the "hotkey" and not when I execute signal with
$ echo "test" > /tmp/fifo & # created w/ `mkfifo /tmp/fifo`
$ kill -SUIGUSR2 $(pidof ida)
Plugin ...
0
votes
1answer
52 views
How can I find the real function that *(_DWORD *)v2 + 24) point to?
How can I find the real function that *(_DWORD *)v2 + 24) point to?
(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);
int __fastcall sub_1(int a1, int a2)
{
int v2; // r4@1
int ...
0
votes
0answers
21 views
Link to function with IdaPython
In my IdaPython script I print function that I found.
print(func_address)
How can I do that if user click on this function (in output windows) Ida will jump to this function?
0
votes
1answer
33 views
Get input with IdaPython
How can I get input from user with IdaPython?
When I tried str = input() ,I got error RuntimeError: input(): lost.sys.stdin
2
votes
1answer
47 views
The questions about li instruction
When reversing a MIPS binary using IDA Pro, I have 2 questions.
The source code is as follows.
int main(int argc, char* argv[])
{
int m = 1;
int n = 5;
printf("sum = %d\n", m+n);
}
....
0
votes
0answers
12 views
Open all object files in Ida
I have archive file , like libc.a .
When I tried to open it with ida, ida ask to choose one object file that contain in archive file.
Is there any way to open all the object files in one Ida project?...
0
votes
1answer
35 views
Reference address by name in Radare2/Cutter
I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:
;-- section.seg_000:
12: entry0 ();
0000:0000 push ds ...
0
votes
1answer
28 views
How to get the current offset use IDC or IDAPython?
When writing an IDA script, how to use IDC or IDAPython to get the file offset for a memory address?
0
votes
0answers
35 views
What does the file pointer of fgets actually point to in linux?
So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer.
now the weird part was that the third argument in this ...
0
votes
0answers
27 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
0
votes
1answer
40 views
is there any way to get type information using IDA Demo
I am using IDA Demo (evaluation version >7). I have a binary:
#include <stdbool.h>
int do_decode(){}
int main()
{
bool decode = false;
char opt = getopt();
switch (opt)
{
case 'd':
...
0
votes
0answers
33 views
Find common functions in arm static binary
According to Detecting libc function with IDA
I have static binary for arm and I want to find common function like fread sleep printf ioctl etc.
When I looking for string in this binary I found glibc ...
0
votes
0answers
37 views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
0answers
30 views
IDA Pro - Binary data xxx is incorrect, maximum possible value is xxx
I'm analysing a shared object (.so) file from an Android app. When I try to disassemble it on IDA Pro, it gives me errors
Binary data xxx is incorrect, maximum possible value is xxx. Do you want to ...
0
votes
1answer
12 views
Appcall on function that uses global variables
I'm reversing an executable, there is a function in the executable that uses global variables that are not used in any other function, they are initiated in the target function, My question is will ...
1
vote
1answer
56 views
Unable to intercept traffic of an android app even after patching ssl pinning
Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
0
votes
1answer
23 views
In IDA's strings window, how to run MakeStrLit on all the selection
Ida allows to turn bytes into a string using the A shortcut
There is also this window to find strings :
You can press enter to jump to a specific string, but is it possible to run MakeStrLit on all ...
0
votes
2answers
46 views
Gui disabled program functionality
Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.
Right now there's one button remaining labeled "Encrypt", which is greyed ...
0
votes
0answers
63 views
CHBByteStream operator<<, get only one argument - value
Anyone heard about CHBByteStream? It's from Harman headunit (car radio). I don't know how it's passing arguments. SWID is 4 bytes, VIN is 17 bytes, it should be connected in some way, to pass thru ...
0
votes
1answer
32 views
Is it possible to dump input file?
Similarly to retrieve_input_file_md5, I was looking for a way to dump a patched input file.
Basically, I would like to do the following:
patch the file in IDA
dump the patched input file to another ...
0
votes
0answers
44 views
Detouring function cause exception access violation
i am learning to detouring functions, but i run into one that i cannot be resolved.
I use the Detour lib from microsoft, and a custom method.
Both cause the same problem, the function is hooked and ...
0
votes
1answer
46 views
IDA subroutine code running when not being called
Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for ...
0
votes
0answers
31 views
Loading garmin Foretrex 601 firmware into IDA Pro
I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin)
But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch.
The GCD file can be ...
0
votes
0answers
47 views
Lua script decode method?
I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script ...
1
vote
2answers
59 views
NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?
I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
-1
votes
1answer
45 views
How to find where a subroutine is being called (ida)
I am reversing an application using IDA. I have found a small subroutine that returns information at the end of that subroutine. However I would like to see the subroutine that uses this small ...
1
vote
0answers
78 views
Decrypting some possibly XXTEA encrypted lua/game files
I am trying to extract assets from a Chinese game, I downloaded the apk file and unzipped it. I looked through the files and they are encrypted in some ways, the PNGs and LUAs are unviewable.
The ...
1
vote
0answers
36 views
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?
As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
0
votes
2answers
71 views
IDA Freeware 7.0 disassemble ARM .so file
I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error:
The processor type 'arm' is not included in the installed version of IDA.
IDA Version: Freeware ...
-2
votes
1answer
68 views
Hash from pseudocode [closed]
What is the hash? Generated from ida pro
int __fastcall hash(_BYTE *a1)
{
_BYTE *v1; // r4@1
int v2; // r5@1
int v3; // r6@1
v1 = a1;
v2 = 0;
v3 = 1;
while ( *v1 )
{
v3 = (*v1 + ...
0
votes
0answers
29 views
Is there a way to identify compression algorithm used in exe file?
I'm trying to find a compression method used in executable file. I tried decompiling it with IDA Pro found a pseudocode of decompression but couldn't compile and use it in my program.
Here's ...
0
votes
0answers
60 views
Pe file Vmp0 vmp1 section,
I have a PE file with section vmp0 vmp1, possible protected with VMProtect. I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the ...
0
votes
0answers
26 views
Does IDA Support Segment Shadows/Aliases
Is it possible in IDA to map a single segment (block of code/data) to multiple addresses in a single address space (a much more limited solution to the problem would be to specify how many address ...
0
votes
1answer
80 views
Does IDA Pro's Freeware version have a command line interface?
Does anybody know if IDA's FreeWare version 7.0 has the Command Line Interface option?
I currently have IDA FreeWare 7.0 and I only see one .exe file which is ida64.exe. But according to HexRay's ...
0
votes
0answers
20 views
Yara sigs based on imported functions used in code snippet
I'm looking to write a yara signature based on an interesting decoding algorithm in a family of malware, but I'm having difficulty with correlating addresses with imported functions.
Specifically, I ...
1
vote
1answer
33 views
Help with IDA pro please — functions made are not Xref'ing to the caller
I am reversing some Motorola 9s12 (68hc12) code and using IDA pro.
I am having the strangest issue.
The code makes a call to a function:
ROM:B300 call $BFF7, #$FE
when I go to ...
1
vote
3answers
94 views
In IDA, why are the addresses of instructions different from the corresponding locations in the original file? How do I find the file locations?
I noticed that if I found an instruction in IDA, the address shown to its left would be wildly different from where it appears in the actual file. I wanted to know why this was the case and how I can ...
0
votes
0answers
23 views
How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?
So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file.
how can i do this in IDA ...
0
votes
1answer
72 views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
