Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,718
questions
0
votes
0answers
10 views
How to simplify a function “calling itself's reference”
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
0
votes
1answer
26 views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
2
votes
0answers
35 views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
0
votes
0answers
20 views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
2
votes
0answers
74 views
How to find “in degree” of chunks divided by ida pro?
I am working on IDA pro. I am splitting an executable in multiple chunks. My purpose is to calculate the possible ways any chunk can be traversed. There might be multiple ways that any particular ...
2
votes
2answers
293 views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
0
votes
1answer
17 views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
3
votes
1answer
97 views
Ghidra + IDA cant detect a string but Radare2 can
Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
0
votes
1answer
37 views
Exporting C++ types from database to another
I have a pe dll binary with it's pdb file. I'd want to use this file's types in another database.
I tried to export the types using "Create C header file" and "Dump typeinfo to IDC file&...
4
votes
1answer
105 views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
0
votes
2answers
51 views
Correct target of absolute jmp in IDA
In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution:
F000:FEFF : mmap'ed location of function ...
2
votes
0answers
42 views
Is there a way to resume execution of a process for a given amount of time then suspend it?
I am using the following IDC script in IDA:
#include <idc.idc>
static main()
{
for (i=0; i<10; i++)
{
PauseProcess();
...
2
votes
1answer
160 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
0
votes
1answer
46 views
Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?
I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
0
votes
0answers
26 views
IDA is already trying to suspend the process crash when debugging kernel?
Unlike Windbg where you can easily stop, in IDA when i want to pause the debugee and click on suspend, IDA says "IDA is already trying to suspend the process" then most of the times it ...
0
votes
0answers
23 views
IDA Windows determine programming language used? or even narrow down to compiler
[Python] So basically if something is written in python it basically screams at you "Hey this is python" if you go to a hexview and see tons of 'py' at the start of a module (pySpark, ...
0
votes
1answer
26 views
How to avoid database / code mismatch when developing and debugging your own code in IDA?
This seems like a very basic use case and I can't get it to work properly. I'm developing my own test application in Visual Studio c++. I want to test it through several IDA debugging sessions. Every ...
1
vote
1answer
52 views
Using windows 10 for malware analysis
I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
2
votes
1answer
36 views
What is the difference between uintX_n (used in IDA Pro) and unitX_t types?
During debugging a binary in IDA Pro, I've noticed types of the form
30 uint16_n 00000002 struct {uint16_t inner;}
42 uint32_n ...
2
votes
4answers
81 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
3
votes
1answer
51 views
IDA Pro “force new variable” for register variable?
IDA Pro 7.2 has a new functionality named force new variable.
See:
Here and Here.
But it is only efficient for stack-based variables. How can I force a new variable for a register-based variables?
2
votes
1answer
33 views
Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
1
vote
1answer
50 views
What does this custom piece of frame manipulation code from a router binary do?
I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary:
pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining)
...
0
votes
0answers
20 views
Configure window behavior in IDA Pro?
On 7.2 and later, IDA Pro would maximize the Window if i press Go and automatically maximize while disassembling, and it would no longer remember the window size anymore. I'm not used to it and I want ...
2
votes
3answers
65 views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
1
vote
0answers
75 views
Right way to reverse a VM
I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
0
votes
1answer
58 views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
0
votes
1answer
34 views
Visual c compiler options
I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA.
This because I need to find a particular funciton with ...
0
votes
1answer
41 views
How to parse the NT headers and section headers of a PE file using IDApython?
I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
1answer
41 views
How to parse the IAT using IDApython?
Is it possible to parse the IAT using IDApython?
i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
0
votes
1answer
100 views
IDA pro 7.5 - No previous fonts / color imports
For the past few years I've been using an ida color scheme which I created, that was very easy on my eyes with the previous versions of IDA Pro (<7.0). However, after start using version 7.5 I ...
1
vote
0answers
22 views
ZTE AES-256-CBC Encrypted backup config file
i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output
Encrypted Data Start Position: 227
...
0
votes
0answers
38 views
Parsing binary file to Idb faster with Ida
When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores?
Is there any way to make that process faster? run it on all ...
1
vote
1answer
30 views
What do the following AARCH64 LDR and STR instructions do exactly?
The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
1
vote
1answer
76 views
Analyze stack with IDAPython
In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack.
char buffer[XXX]; // [sp+YYh]
How can I get that information (buffer size and place of this buffer ...
1
vote
2answers
66 views
Find assembly in binary with ida python
I want to find 2 consecutive instructions with Ida python
move r2,r3 ; move r2 r4
What is the easy way to find the addresses of that with Ida python?
I can Iterate on all Functions and for each ...
0
votes
1answer
48 views
Converting a data address offset to the equivalent struct in a C++ module
I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so:
v32 = ( v3 + ...
0
votes
2answers
34 views
IDA how to view path between 2 functions
I like to view the path between 2 functions with IDA 7.0.
I have already tried with "function browser" but not work becouse these 2 functions are not linked.
For what I see there is no way ...
0
votes
0answers
32 views
Issue Debugging in IDA PRO
I am analyzing a binary file to retrieve the password. It requires a userID and password. By analyzing I need to crack the password. But after running through IDA it is being terminated.
First, I used ...
0
votes
1answer
49 views
Ida python find function address that using string
I have string at address 0xaaaa that I want to know the address of function that use this string
import idautils
len(list(idautils.XrefsTo(0xaaaa,1)))
return 0
Why is that ? When I tried this code ...
0
votes
0answers
19 views
Function obfuscation with hundreds of LDR PC, what is it called and how is it generated?
I am working on some obfuscated code. To my understanding, here is how the obfuscation works:
Take the subroutine you want to obfuscate, like;
LDR R2, [R0,#8]
MOV R0, #0
CMP ...
1
vote
1answer
63 views
IDA plugin to show xrefs to virtual functions?
I'm analyzing a C++ PE binary with its debug symbols using IDA 7.3 w/ the decompiler.
I'm using the HexRaysPyTools plugin to get the xrefs to class fields, but it doesn't show xrefs to virtual ...
1
vote
2answers
83 views
How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?
The context:
For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: ...
1
vote
0answers
17 views
Creating stack variables when they are addressed by non-SP register
So, I have ARM code which uses R7 as the register to access the stack variables:
In the first basic block IDA successfully identified R7 as stack pointer and created the variables. But then, after ...
1
vote
0answers
40 views
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
0
votes
2answers
61 views
cdecl calling convention
Hello best people, my question is this example is telling me about cdecl calling convention. I have confusion that when analyzing the code in disassembly how would I recognize that this is the cdecl ...
0
votes
1answer
50 views
How use signature pattern for hooking
I like to replace the static function address:
AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer)
using signature pattern:
SigScan ...
4
votes
3answers
2k views
Is Null in Windows equal to zero?
(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
2
votes
2answers
61 views
BRANCH OCCURS in IDApro
Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below:
As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
1
vote
1answer
50 views
IDA - Rename Address/Function: Says name exists already but it does not show up anywhere
I am trying to rename a function address in IDA (free) and it says that the name I picked already exists in the database (Error Code: 8727B0) ... but the provided name does not show in the functions ...
