Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0 votes
1 answer
24 views

Using IDA pro decompiler in Ghidra

Is it possible to use IDA pro decompiler in Ghidra ? I know the opposite is possible.
user avatar
  • 1
0 votes
1 answer
34 views

My IDA have 2 different address for same code How to change it

I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
user avatar
1 vote
1 answer
48 views

Turning very complicated arithmetic and reverse engineered check into useable code in C#

so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
user avatar
1 vote
0 answers
50 views

jump to invalid address when emulating

I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
user avatar
0 votes
0 answers
30 views

How to extract byte arrays? [closed]

I have .bin file from Counter-Strike: Global Offensive game. How can I extract byte arrays from this file? Download link to file (File size:10.8 MB)
user avatar
0 votes
1 answer
37 views

Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header

I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum. file output: libTheArmKing.so: ELF ...
user avatar
2 votes
1 answer
58 views

Decompilation output modification in IDA Pro

I am trying to modify cfunc AST from If (a1 && some_func_ptr) { some_func_ptr(); } To if (a1) { some_func_ptr(); } But I constantly get INTERR 50683 error. I tried new_item = idaapi....
user avatar
  • 71
1 vote
0 answers
34 views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
user avatar
  • 219
1 vote
1 answer
45 views

Automatically name class methods in IDA

Let's say I have: mov ecx, [g_pMyClassObj] ; type CMyClass call sub_B00BA ; a thiscall function Is there a feature/plugin/script to automatically rename all subroutine occurrences to: mov ecx, [...
user avatar
0 votes
0 answers
14 views

IDA debug function spawned by pthread_once

I am using IDA to debug android, some libs use pthread_once/pthread_create function to call a function. How do I use/set up IDA to debug the function passed to pthread_once ?
user avatar
1 vote
0 answers
38 views

Wrong EP on an .elf CrackMe

I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)......
user avatar
0 votes
0 answers
34 views

What is the most effective tool to analyze apk file

I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes. However, I am facing an issue for ...
user avatar
  • 1
1 vote
0 answers
60 views

Ida Pro can't decompile big function

I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error : The graph is too big (more than 1000 nodes) to be displayed on the screen. Switching to text mode. (you ...
user avatar
  • 183
0 votes
1 answer
62 views

How to import Ghidra DB into IDA?

I see many questions about how to import IDA DB into Ghidra but I interesting in the backside. I want to export Ghidra DB and import it into Ida PRO. How I can do that?
user avatar
0 votes
0 answers
30 views

Problem to hook a parameter with _thiscall function

I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function: .text:00488DA0 ; =============== S U B R O U T I N E ==========================...
user avatar
0 votes
1 answer
77 views

How to speed up finding a function from pseudocode in IDA?

I have a function with the pseudocode of __int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3) { if ( qword_7FF709F91498 ) return (*(__int64 (__fastcall **)(ID2D1Geometry *...
user avatar
3 votes
2 answers
299 views

Where does IDA load binary in Ida64.exe process?

I quickly checked the address range shown in IDA within the ida64.exe process using a kernel debugger, and the memory is question marks, indeed there is no VAD allocation for the range. I don't want ...
user avatar
0 votes
0 answers
31 views

Is there any reason to define a struct instead of a local type in IDA pro?

It seems to me that there is no reason whatsoever to define an asm-style struct rather than a C-style type. A C-style struct type can contain references to floats and doubles, user defined types, and ...
user avatar
1 vote
1 answer
50 views

Static Code Analysis of a C166 function

I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
user avatar
  • 51
0 votes
2 answers
64 views

Renaming a local stack variable with IDAPython

I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so... In my ...
user avatar
1 vote
1 answer
67 views

What is j__ftol2_sse_excpt in IDA?

I was inspecting the c-pseudocode for a PE executable in IDA. I found some function called j__ftol2_sse_excpt() When I open that function I see that the function is calling another function named ...
user avatar
2 votes
1 answer
70 views

How to debug cfg80211.ko

I have an Linux embedded device that I want to debug the cfg80211.ko I have full root SSH on that device. How can I debug cfg80211.ko?
user avatar
1 vote
1 answer
36 views

Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction: from capstone import * from capstone.x86 ...
user avatar
  • 1,446
1 vote
0 answers
28 views

IDA throws "Module <lib> has no names" error after attaching a remote process

I am using IDA for debugging a remote process. After set IDA_LIBC_PATH to a correct libc.so in my android device to resolve IDA multi thread problems, I cannot get a list of export functions of ...
user avatar
0 votes
0 answers
31 views

Convert IDA imagebase to detours

I have succefully hooked a game with imagebase 400000 (Ex: // LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4) Game.SecondaryFunctHookAddress = "0x2D5040" and the ...
user avatar
1 vote
0 answers
48 views

How to solve bad pseudocode format of Hex-Rays Decompiler?

Look at the following pseudocode: void *__cdecl func(const char *a1, int a2, void *a3) { _DWORD *v3; // esi int v5; // ebp int v6; // eax void *v7; // esi _DWORD *v8; // eax int v9; // edx ...
user avatar
  • 129
1 vote
0 answers
32 views

IDA how to remove all uses of a type?

I'm editing an exe which has a function that is used in multiple places with completely different meanings for the return type (a getter that wasn't inlined). I had assigned it a return type to make ...
user avatar
  • 73
2 votes
0 answers
36 views

Disable IDA Downloading Symbols Automatically

How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.
user avatar
0 votes
0 answers
53 views

Rebasing program

When I start debug in IDA, it's appears small window "Please wait... Rebasing program", and it's take about 3 minutes. Is it possible eliminate this process named Rebasing program? It take ...
user avatar
  • 113
0 votes
0 answers
72 views

How to byte patch a longer hex/byte from the original?

I am fairly new to IDA PRO I hope this is not some kind of stupid question but please bare with me. How do you change patch a hex/byte that is longer than the original? Example: When I try to byte ...
user avatar
0 votes
1 answer
67 views

What is libm_sse2_sin_precise() and how to find it's parameters in IDA?

I'm new to reverse engineering with IDA. I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable. I tried clicking that function but the executable requires the DLLs. ...
user avatar
  • 1
0 votes
1 answer
105 views

How can I override a x86 instruction in c++?

I am trying to replace a jmp instruction with a ret in c++. How can I do that?
user avatar
  • 11
0 votes
0 answers
39 views

Handling stack strings in IDA, but with a twist (wchar_t-based, not char-based)

Consider the following disassembly: mov dword ptr [rbp+430h+var_458], 690068h ; L'i' + L'h' mov dword ptr [rbp+430h+var_458+4], 2E0064h ; L'.' + L'd' mov dword ptr [rbp+430h+var_458+8], ...
user avatar
  • 10.5k
0 votes
1 answer
27 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
user avatar
4 votes
1 answer
91 views

Can I get back an exe file from an .Asm formatted file disassembled with IDA?

I actually have a .asm formatted file. This file was certainly obtained by disassembling an original exe file with IDA and then save as an .asm file. Now I have this .asm and I would like to get back ...
user avatar
0 votes
2 answers
99 views

What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?

How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other. Based on asking others ...
user avatar
  • 125
0 votes
1 answer
90 views

How can I use cutter like ida, trying to search by address

I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
user avatar
2 votes
1 answer
127 views

Load to Ida binary with all of SO

I have a Linux ARM binary with a lot of shared libraries. Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
user avatar
-1 votes
1 answer
155 views

How to call and what means: _DWORD *__thiscall

I have one question maybe you can help, I always find this functions in IDA: void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4) And I use them like this: // talkChannel typedef DWORD(...
user avatar
  • 131
1 vote
0 answers
31 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
user avatar
0 votes
0 answers
31 views

Restore debug symbol for a embedded .bin image with an .axf file

I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device. The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
user avatar
0 votes
0 answers
43 views

How can IDA Pro disassemble paged memory from HCS12 processort?

I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory? If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
user avatar
1 vote
1 answer
78 views

How to define an xmmword variable in IDA?

How to define an xmmword variable in IDA? IDA identified one variable as xmmword but I can't find a menu to define other variables around it as xmmwords: I also tried to set the type after pressing ...
user avatar
  • 206
1 vote
0 answers
35 views

In IDA is there a way to load the PE headers after the initial loading?

This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it. But suppose I have already worked on an IDB for a while and realize that ...
user avatar
  • 10.5k
1 vote
0 answers
38 views

Warning: struct->til conversion failed

In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code. So I created a struct from the selection (Create struct from ...
user avatar
  • 10.5k
2 votes
1 answer
134 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
user avatar
  • 49
1 vote
1 answer
122 views

idapython: how to reset pointer type for variables

I am using IDA Pro 7.6 on win32 x86 binaries. I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
user avatar
0 votes
2 answers
106 views

How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?

In IDA, I have the following disassembly code (from an old 16-bit DOS application) : les bx, _Foo mov word ptr es:[bx+84h], 0FFFFh mov word ptr es:[bx+8Ch], 0FFFFh mov word ptr es:[bx+...
user avatar
  • 341
1 vote
1 answer
82 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
user avatar
  • 1,447
0 votes
1 answer
44 views

Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?

As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
user avatar
  • 115

1
2 3 4 5
40