Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0
votes
0answers
2 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
1answer
19 views

Exported DLL function has only stdcall with some offset

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...
0
votes
1answer
28 views

Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro

Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis. cseg04:3044 loc_105D4: ; ...
0
votes
1answer
34 views

Why won't IDA let me name this variable?

I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it. The name didn't propagate over to the program, as you can see in the mov ...
0
votes
1answer
23 views

Confused about address being referenced

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
0
votes
1answer
27 views

Building micro controller memory image in IDA

I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format. Some relevant information from the datasheet: ...
0
votes
0answers
18 views

IDA taking forever to run autoanalysis on remote Android app?

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
0
votes
1answer
22 views

Save ida64 database as 32-bit

I accidentally ran ida64 on a 32-bit binary so I can't use the decompiler. Can I save it as a 32-bit database so I can open it in ida?
1
vote
1answer
35 views

Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...
1
vote
2answers
67 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
0
votes
1answer
23 views

IDA Pro jump to offset of DWORD

I have the following instruction in IDAs Decompiler: result = data[3 * a1] + ptr; and would like to know what is at the position if a1=60. So I have to look at data[180]. Unfortunately all I see ...
0
votes
1answer
90 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
0
votes
1answer
66 views

IDA 7 not dissasembling NEC v20 code

So I have an embedded machine from the late 80s I want to mess around with. It uses a NEC v20HL which is an 8088 compatible with some extra 80186 instructions tossed in. I know it uses 64k code ...
0
votes
0answers
128 views

how can i decrypt huawei HG531s v1 config file?

I have tried to follow this guide but libxmlapi.so didn't have the required ATP_GetInfo1 function so i moved to the next file libhttpapi.so it had ATP_GetInfo1 ATP_GetInfo2 ATP_GetInfo3 ...
1
vote
2answers
114 views

Trouble when reverse engineering a industrial robot software in order to get some values

For the bit of background, I'm a robotic engineer. Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
2
votes
2answers
71 views

How can I pass input to my program while debugging it with IDA

I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
0
votes
1answer
68 views

Identify function in cpp static binary

When I open cpp static binary, how can Identify known function like fopen/ioctl/printf ? They compile statistically into binary I dont know the compiler of this binary .
2
votes
1answer
72 views

Finding address in IDA from address found in Cheat Engine

I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
0
votes
0answers
45 views

Decode message in esoteric audio file

I'm having a reverse engineering lab at school and my last project is to beat a 10 level reverse engineering CTF-like challenge. It's got plenty of interesting things. What I need to do is find a ...
0
votes
1answer
66 views

IDA freeware (v7.0) exporting Hex-View A

I'd like to export the Hex View generated from IDA to a file with the addresses intact similar to the .LST files generated for assembly instructions. The closest I've come to generating this file is ...
0
votes
1answer
62 views

IdaPython aob search and rename example

Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying ...
1
vote
2answers
104 views

Can't find any string with IDA, why?

A friend asked me to make some small mod on a app. The mod should be to rewrite some labels like button, textbox text into his language, so he can better understand the app... I loaded the app to IDA ...
0
votes
0answers
85 views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
0
votes
1answer
50 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
0
votes
1answer
46 views

Search string in all binary pesudo-code

How can I search pesudo code string in all functions in binary with Ida?? Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c) I want to search for example where ...
1
vote
0answers
51 views

How does IDA provide function names to dynamic calls?

I'm trying to compare a binary (a basic hello world exe compiled with MinGW) within Immunity Debugger and IDA. In Immunity I notice a call to EAX which points to 004019c0. Looking in IDA I notice ...
1
vote
1answer
40 views

IDA Copy structure from one database instance to another

This question sounds rather simple, but I can't seem to find any option for this. I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
2
votes
0answers
47 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
1
vote
0answers
31 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
2
votes
0answers
98 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
1
vote
0answers
39 views

How is sprintf() identified by IDApro? [closed]

#include<stdio.h> int main() { char buffer[50]; int a = 10, b = 20, c; c = a + b; sprintf(buffer, "Sum of %d and %d is %d", a, b, c); // The string "sum of 10 and 20 is 30" ...
2
votes
2answers
90 views

GetProcAddress with 0 as lpProcName

I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code. The binary is a 10 level reversing game where you get ...
1
vote
1answer
38 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
0
votes
1answer
125 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1
vote
1answer
40 views

MEMORY macro in IDA Pro pseudocode

I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example: int S_u8init_flag = 0; // ...
1
vote
0answers
65 views

Using IDA to find pointer passed to procedure

Loading the source into IDA, I have this function: According to the source for Lua, this function should be passed a pointer to the Lua_State struct: LUA_API int lua_gettop (lua_State *L) { return ...
2
votes
1answer
122 views

Is this really a function IDA could not decode?

I have the following IDA output: BEGTEXT:00415A2C read_dpc_sub_415928 endp BEGTEXT:00415A2C BEGTEXT:00415A2C ; --------------------------------------------------------------------------- BEGTEXT:...
0
votes
0answers
37 views

what is Ida Name Tab

I know what is Function tab (show all function) and what is String tab(show all string) and Import , Export .... But what is Name tab? what should I expect see there? and how Ida get this information ...
0
votes
0answers
50 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
25 views

Changing a string pointer while debugging

I'm facing an issue, and I'm not sure what is the best way to handle it. While debugging a program (x64, windows), the program copies certain string using errno_t strncpy_s(char *restrict dest, ...
0
votes
1answer
87 views

How to find out address in binary file (like IDA) with python code only?

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
0
votes
1answer
103 views

Ida - what is Parse C header file

In ida File->Load file there is option Parse C header file, I want to understand that . If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
0
votes
0answers
31 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
0
votes
0answers
63 views

IDA change string in rdata

This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php? toquizwammer.github.io Thanks.
0
votes
0answers
25 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
95 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
115 views

Red text Highlight in IDA Pro

Why do some command in IDA have red text highlight around them? e.g.
0
votes
0answers
129 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
2
votes
1answer
102 views

IDA “unk_XXXXXX” meaning? [duplicate]

I am new to reverse engineering. Today when looking at IDA, I found this if ( *(_UNKNOWN **)(this + 8) == &unk_4EDC58 ) but I dont understand the part "unk_4EDC58". So can you help me ? Thank ...
0
votes
0answers
19 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...