Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
0 votes
2 answers
58 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
1 vote
1 answer
43 views

Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?

Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version. Problem is i have to do it again cause there ...
0 votes
0 answers
24 views

Working with IA64 in IDA Pro

When disassembling IA64 code in IDA Pro when I try to open the Local Types window i get an error: Sorry, the current processor doesn't support the type system
  • 130
1 vote
0 answers
26 views

Access a XREFs with frida

I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
  • 41
1 vote
0 answers
32 views

Corrupted IDA database .i64 file (Empty Header)

Im my 10 years using IDA Pro this never happend. I saved using IDA Pro 7.7 when I go to open today I find out that IDA PRO didnt put header on file If I try to open says "File .... is not an IDA ...
  • 11
1 vote
0 answers
27 views

IDA api: get function argument definition

So let's say we have the following code: 0: lea rax, [rbp+8] 1: mov rcx, rax 2: mov rdx, 5 3: call my_fun i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
  • 21
1 vote
0 answers
22 views

After jumping to a new segment, it warns "The memory could not be written"

I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that &...
1 vote
0 answers
57 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
  • 31
4 votes
1 answer
240 views

How to make pseudocode in IDA more human readable

Some codes in IDA are not clear enough. Especially when they do reference after calculation while ( dx33[rdi24] ); if ( rax35 != &WPP_GLOBAL_Control && (*((_BYTE *)rax35 + 68) & 2) !=...
1 vote
0 answers
15 views

How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]

I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
  • 111
2 votes
1 answer
43 views

Function pointer as struct field in IDA

I have following function: void __thiscall ParsePackage_v5(package_t *package, stream_t *stream) { (*(*package->stream + 8))(package->stream, package, 4); } .text:0069F5A0 ; void __thiscall ...
1 vote
0 answers
68 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
  • 1,708
2 votes
0 answers
33 views

How to force IDA to show size of pointer dereference?

IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register: mov ecx, ...
2 votes
2 answers
117 views

Reverse function in .rdata field

I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll. However, it appears in .rdata section in the .dll ...
1 vote
0 answers
62 views

How to call the Color Picker window in Ida Pro from a script?

I'm going to make a python script that allows you to color selected functions - in the right colors. To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
  • 130
0 votes
2 answers
81 views

How to use IDA pro to find ALL strings in an exe file?

I've been using IDA for some time and most of the time I can find the strings I am looking for in the String panel. In one of the recent exe files I was working on, many string are missing, or not ...
2 votes
1 answer
53 views

How to create a function graph in IDA? Could not find grapher (Linux)

IDA (free v8.0 on Kali Linux) produces an error any time I attempt to create a graph, e.g. View > Graphs > Function Call: Could not find grapher '/usr/bin/dotty'. Please check GRAPH_VISUALIZER ...
  • 53
2 votes
1 answer
105 views

How to hide Remote Windows Debugger in IDA Pro?

Whenever I try to debug a 3D game through VMware and IDA Pro, an "access violation" pops up. The error occurs in the body of the program after memory is allocated by the operator New. ...
  • 130
1 vote
0 answers
30 views

Find an address of injected code via GetModuleHandleA

I am reversing really old game (20 years old). l2.exe loads Dsetup.dll Network.dll. (not sure about order) inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
1 vote
1 answer
38 views

Infer function parameter types from caller argument type in IDA

So i have the following code: struct my_struct_t var1; fun(var1); I don't have the symbols for fun's parameter type but since it's called with an argument with type my_struct i would want IDA to ...
  • 21
2 votes
0 answers
24 views

Find location to override PC by stack frame with stackoverflow

I have stackoverflow in MIPS arch (without ASLR/canary) In Ida I see that the buffer that has the overflow located in SP+200 In the beginning if function I can see the stack size because I see the ...
1 vote
0 answers
69 views

Fail to load pdb file in IDA

I'm following this post to set my IDA symbol path How to configure IDA to load .pdb files from Microsoft public symbol server? I added a system variable called _NT_SYMBOL_PATH with value SRV*\C:\...
0 votes
0 answers
27 views

RDATA Section Strings

I have been reversing a binary and trying to make sense of it, which is basically a go malware, there are lot of important strings at the .rdata section, but right now am not sure where this strings ...
0 votes
0 answers
65 views

What is the meaning of this message in IDA?

What is the meaning of this mmessage in IDA: The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
0 votes
0 answers
43 views

IDA binary patch "has no file mapping"

I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to ...
  • 1
0 votes
1 answer
45 views

ida pro: scripting debugger with python fails on step_over/run_to

So I am trying to run an app and collect information at certain points. No biggie, right? Wrong. Check this simple example: import ida_dbg ida_dbg.step_over() #or runto() eax = ida_dbg.get_reg_val(&...
0 votes
0 answers
58 views

Can someone help to understand code disassembly by IDA?

Can someone help to understand code disassembly by IDA? Basically this use for calculate key from seed. Here I would like to understand the logic and also I would like to know what would be the output ...
  • 1
0 votes
0 answers
26 views

Can anyone help to understand how Calli function work?

Can anyone help to understand how below function works? Below is C# code which calls c++ dll function. Utils.Conversions.GcStrToStdStr(accessMode, ref struct2); _Common* nativeCommon = this....
  • 1
0 votes
0 answers
42 views

IDA Pro maps wrong variable for offset

I hope there is a proper way to fix my issue. Here's memory layout: .data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r .data:004F3D10 ...
2 votes
1 answer
191 views

How do I reverse an exe packed with an unknown packer?

I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used... How can I unpack it if it's possible? ...
  • 23
2 votes
1 answer
87 views

Identify two structs in IDA

When decompiling an exe file, I have defined two structs struct A and struct B that are of the same structure. They appeared under different contexts, thus I assumed that they were different structs. ...
  • 123
0 votes
1 answer
40 views

WinGraph32 for the OllyFlow plugin

I am trying to use the OllyFlow plugin for OllyDbg 1.10. It requires WinGraph32.exe, which was apparently distributed with IDA at some point, because the book Game Hacking says: Wingraph32 is not ...
  • 103
2 votes
1 answer
66 views

Am I missing symbols when RE'ing shellcode?

I have a question about reversing a tutorial which shows how to reverse engineering shellcode. My question is simple: In figure 4, we see at (7) TEX.ProcessEnvironmentBlock: is this a comment, or was ...
1 vote
1 answer
44 views

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

We have an EXE that IDA pro lists the following segments: Name Start End R W X D L Align Base Type Class AD es ss ds fs gs cseg01 00000000 0000EA50 ? ? ? . ...
1 vote
0 answers
379 views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6 wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files not ...
1 vote
1 answer
34 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
  • 43
1 vote
1 answer
38 views

Cannot reset botched IDA setting

I managed to accidentally modify the opcode column setting of the view window to display the data in word format (2 byte). For the life of me I cannot seem to figure how to switch if back to byte ...
  • 11
3 votes
1 answer
92 views

How to select an item in IDAPython, in decompilation view?

I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures). I have changed the arguments types for a list of ...
  • 168
1 vote
1 answer
118 views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
  • 113
1 vote
0 answers
49 views

Auto-loaded type information and relationship between .til and .sig: how to find links and how to change them (config)?

NB: most of my targets are PE files for pc, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm. Let's say I load a PE ...
  • 10.6k
2 votes
0 answers
120 views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
3 votes
1 answer
75 views

View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra

I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
0 votes
1 answer
67 views

IDA not allowing Memory Mapping

I own an electronic instrument that has video display which has a horizontal timing issue. The graphics display initialization is done in a 256K bootrom and the desire is to use IDA to reverse the ...
  • 11
2 votes
0 answers
202 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
  • 189
0 votes
1 answer
52 views

Why does tif.get_func_details sometimes only starts to work after decompiling the function?

I am going through a huge executable and am fetching information about functions arguments this way: tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t() assert ida_nalt.get_tinfo(...
  • 168
0 votes
1 answer
92 views

IDAPython Get Function Parameter Type Name

I'm currently trying to make a hotkey to rename example functions sub_123450(aType* this, void* a2) to aType::123450(aType* this, void* a2). I have code to rename etc. but how can I get the name of ...
  • 75
0 votes
1 answer
149 views

Using IDA pro decompiler in Ghidra

Is it possible to use IDA pro decompiler in Ghidra ? I know the opposite is possible.
  • 21
-1 votes
1 answer
50 views

My IDA have 2 different address for same code How to change it

I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
1 vote
1 answer
64 views

Turning very complicated arithmetic and reverse engineered check into useable code in C#

so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...

1
2 3 4 5
40