Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
0
votes
1answer
8 views
How to load a color theme correctly in IDAPro?
I work late nights and a dark theme like this would be nice with IDAPro.
I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
1
vote
0answers
42 views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
1answer
34 views
IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?
I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
1
vote
2answers
97 views
IDA Hex-Rays: How to SAFELY fix incorrect function declarations?
Update:
The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions:
.text:00403F2F 074 ...
0
votes
1answer
59 views
IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?
This question has already been asked here but for some reason it was deleted, as "dead".
I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...
2
votes
1answer
64 views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
1
vote
0answers
22 views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
0
votes
1answer
58 views
Combine various sub routines into one sub routine (IDA Pro)
Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
-1
votes
0answers
30 views
IDA Dalvik debugger on Andoid Device JDWP error: INVALID_OBJECT
IDA Dalvik debugger on Android Emulator throws JDWP error: INVALID_OBJECT, and then IDA hangs and not able to figure out why its happening.
0
votes
1answer
66 views
How to detect md5 and sha256?
I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256.
How can I detect md5 in assembly?
How can I detect sha256 in assembly?
thanks
0
votes
1answer
63 views
finding file I/O in IDA Pro (actually IDA free)
Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff.
The parts of the program I am interested in is where it reads a file. This is a ...
0
votes
1answer
47 views
ida pro issue debugging issues with ntdll [closed]
I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s
I am facing a problem when i try to put a break point on functions in ...
0
votes
1answer
33 views
Remote debugger for Linux from one VM (IDA) to another (running the debuggee)
I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).
So, is it possible to debug if both ...
-1
votes
0answers
42 views
Can IDA Pro extend a string length?
I am trying to localize IDA Pro 7.0 macOS version to Chinese. Strings have translated, most of them work fine. Only a few strings have problem.
For example, string "Save" translates to Chinese is "保存",...
0
votes
1answer
42 views
Calculate LEA operand
I have those opcodes on 64 bits:
48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb].
How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
1answer
47 views
How to identify if buffer allocate on stack or heap?
When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer.
How can I know if this buffer allocate in stack/ heap?
2
votes
0answers
132 views
Unable to figure out how to map segments in IDA
I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU.
The segments go from 4000 (0x140000) to F000 (0x1F0000).
I'm attempting to map the segments in ...
0
votes
1answer
49 views
How to see address in Graph view Ida
In Ida when I want to see the address of code I must switch to Text view
How can I see the address of code with Graph view ?
By the way, is there grapgh viwe in OllyDbg?
1
vote
1answer
56 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
1answer
54 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
4
votes
1answer
61 views
Z80 Absolute Jump to offset in middle of instruction
I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another ...
-1
votes
1answer
98 views
how should i change an instruction to NOP in IDA?
I am new with IDA assembler and i used to work with hopper app.
the problem is i can't change instruction in IDA from something like CBNZ to NOP.
is there any button to do this? i can't find anything ...
0
votes
1answer
125 views
How to export function from exe file?
I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code.
How can I export function that I Know the name ...
1
vote
1answer
54 views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
2answers
122 views
How to identify base64 encode/decode in assembly
How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that?
FindCrypt2 Ida plugin not find that
0
votes
1answer
53 views
Show arguments while debugging
I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program.
Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
2
votes
0answers
53 views
IDA rename argument in all xrefs to function
I have a function of the format:
sub_ABCDEF(&global, "stringName", unimportantValue)
push offset string
mov ecx, offset global
call sub_410010
That is called in several places, each ...
0
votes
1answer
85 views
IDA Interpreting mov instructions in a unusual way
When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset.
Hex rerpresentation: 8B 40 0A
Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
2
votes
2answers
130 views
Why are there so much more functions in ida than my source code?
I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
3
votes
1answer
114 views
How to wrap dump process and execute it in another PC
I debug exe file in Ida , and put breakpoint in some address.
I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
1
vote
1answer
75 views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
1
vote
1answer
85 views
How to decompile ARM (iOS) to Objective-C using IDA?
What are the options to decompile ARM (iOS) to Objective-C using IDA?
I've been looking into the REobjc module (https://github.com/duo-labs/idapython), but it can only handle x64 code.
Are there ...
2
votes
1answer
52 views
What is __sighandler_t struct and purpose of SIGTRAP signal handler
I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value :
.text:08048063 ...
4
votes
3answers
153 views
How to run part of exe file that is being reversed
I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it.
How can I run an exe file from a specific ...
1
vote
1answer
76 views
What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?
I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
2
votes
1answer
115 views
IDA Dump Memory
I am learning how to use IDC Scripting,or IDAPython in IDA for Reversing binary.One day i face this problem:
You are given an array of random integer(4-byte integer) lies within the memory .The ...
3
votes
2answers
112 views
Can't find SetCooperativeLevel call in disassembled program
I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
0
votes
0answers
53 views
How is DS register interpreted in x86-64 assembly instructions?
IDA disassembled an x86-64 instruction as below:
0000000000000761 lea rdx, ds:0[rax*4]
What I know is, segment registers are only relevant in in segmented memory model, while in ...
0
votes
1answer
120 views
How can I make IDA understand this switch statement with a signed jump table?
I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0:
int main() {
int a = 0;
for (int i = 0; i < 5; i++) {
switch (i) {
case 0:
a = 1;
break;
...
0
votes
0answers
52 views
IDA SDK: How to add a struct (pointer) field to a struct?
I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows:
00000000 SomeClass struc
00000000 ...
1
vote
2answers
82 views
Get Multiple Function Names for One Address in IDA
I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
1
vote
2answers
133 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
2
votes
1answer
128 views
IDA does not create Vtbl structs for child classes loaded from PDB
I'm decompiling a MFC 4.0 application, and now loaded the MFCS42.PDB from the MFC 4.2 source into IDA 7.0 (not having the MFC 4.0 source) to make it create the appropriate structs representing the ...
1
vote
0answers
53 views
View XMM registers in IDA Pro while debugging
How can I view the XMM registers in IDA Pro?
While debugging, I can only view the default registers and eflags. Is there a way to view the XMM registers, xmm0 to xmm7?
Thanks.
0
votes
0answers
63 views
Assemble function of IDA Pro not working properly
I am using the Patch Program option of IDA Pro to edit the assembly of a binary at runtime.
When I enter the following instruction:
mov rax, [rsp + 0x48]
I get an "Invalid operand" error from IDA ...
0
votes
0answers
45 views
Getting function arguments with IDA: When do function prototypes exist?
This post explains how to get function arguments using idapython.
However, I read here that get_arg_addrs() requires the prototype of the called function to be present.
My question: In which cases ...
0
votes
0answers
52 views
How to remove all goto statements in pseudocode?
IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...
2
votes
1answer
117 views
How to load firmware x86 BIOS into IDA Pro 7.0
I have a file called bios.bin which is the firmware of an ATM machine and I have found out it is x86 code 16-bit. But I don't understand how I'm supposed to set the base address in IDA Pro for an x86 ...
1
vote
1answer
68 views
While loop function disassembly x86
I am trying to convert this binary to C but I am having trouble with the while loop. What does
sub esp, 8 mean? as well as push [ebp+_a] ? I am able to get the esp 8 sometimes while changing the ...
0
votes
1answer
126 views
IDA remote linux Debugger attach to a running process
I usually use remote linux debugger as shown below:
./linux_server bin
And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
