Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
25 views

Flags setup in code

There is C++ structure: ... //structrue flags uint16_t loaded : 1; uint16_t intelligent : 1; uint16_t save_position : 1; uint16_t save_hitpoints : 1; ...
black4's user avatar
  • 331
0 votes
0 answers
20 views

sp analysis failed - red marks in code

This is start of func: https://imgur.com/n0jbT1E This is end of func: https://imgur.com/GiQQAYP What means red mark "sp analysis failed"? I looked in C++ source code of this disassembled ...
black4's user avatar
  • 331
0 votes
1 answer
44 views

Shift operation and subtract in code

There is C++ code: int16_t ** g_Meshes; int32_t m_MeshPtrCount; int16_t * g_MeshBase; uint32_t *mesh_indices; for (int i = 0; i < m_MeshPtrCount; i++) { g_Meshes[i] = &g_MeshBase[...
black4's user avatar
  • 331
0 votes
1 answer
34 views

Сode in IDA breaks off

My code breaks off, and then the code color is red, like in the screenshot, a fragment of a function. What can you do here? How to restore the code? Is there a keyboard shortcut for this?
black4's user avatar
  • 331
0 votes
0 answers
21 views

Can Ghidra load a directory and translate the binary files within it into assembly code?

Can Ghidra load a directory and automatically convert the binary files within it into assembly code? If not, is there a pre-defined script available, or do I need to write one myself? If Ghidra isn't ...
0xh3xa's user avatar
  • 111
0 votes
0 answers
47 views

Hex-View in IDA [TMS320C3x]

For the target processor TMS320C3x, IDA does not display all data in HEX-VIEW as ASCII, only every 4th byte. The minimum addressable data block for this target processor is a 32-bit word. It seems ...
strannyi's user avatar
0 votes
0 answers
25 views

How do I force IDA to reload PE Header and/or segments?

Introduction I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called "....
Kyuuri's user avatar
  • 1
1 vote
0 answers
38 views

Unknown string encoding

I'm new to reverse, my question may be stupid. I am trying to reverse a function in the application that reads a string at the address and concatenate it to another char[250] v30; char[20] v31; ... ...
SHVED's user avatar
  • 11
0 votes
0 answers
21 views

How to access the demangled auto comment?

In this example, IDA has demangled the boost::fibers::context::active name normally, and you can access that name with ida_name.get_ea_name(ea, GN_SHORT|GN_DEMANGLED|GN_VISIBLE). But the function name,...
thejoelpatrol's user avatar
0 votes
0 answers
19 views

How can I use ptr to ptr in idapython?

in hey-rays api there's a method: def find_def(self, *args) -> "minsn_t *": r""" find_def(self, op, p_i1, i2, fdflags) -> minsn_t @param op: mop_t const &...
Ethan Xie's user avatar
0 votes
0 answers
30 views

Ida Pro: how do I iterate over all typedefs in python

I see how to iterate over all structs, unions, enums, functions. But I cannot find a way to iterate over all typedefs.
thatshowthe's user avatar
2 votes
0 answers
51 views

Changing instruction that was misidentified in IDA Pro

I am trying to compare a source code to a disassembled version of a Sega Genesis (68000 processor) game. I ran the binary through IDA Pro 7.7 to disassemble it, and when I was going through the code ...
John G's user avatar
  • 21
0 votes
1 answer
53 views

how to print non printable address using python

i have been doin ctf challenge and came across a problem when i have to push the address of a function into eip{instruction pointer} by overflowing the buffer but the main problem here is that the ...
Zishan Ansari's user avatar
0 votes
1 answer
55 views

Offset addressing

I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation: in code I ...
Andynvkz's user avatar
0 votes
1 answer
80 views

IDA - Decoding this "XORed"? string automatically in psuedocode

__m128i ModuleName; __m128i ProcName; ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64; ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64; ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64; ProcName....
lightersmash's user avatar
0 votes
0 answers
24 views

I loaded an unpacked base and it broke some structs. How can I fix them?

So I, against my best judgement, loaded an unpacked base after IDA crashed on me. And despite thinking to make a backup before doing that, I didn't do it. So now I'm stuck with 4 broken structs. The ...
ZivDero's user avatar
  • 21
0 votes
1 answer
113 views

Hooking a function

So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
Reaper's user avatar
  • 1
2 votes
0 answers
99 views

Vtables in objects with inheritance in IDA

I'm struggling to get object inheritance working in IDA. The original structure is as follows: INoticeSource : INoticeSink IRTTITypeInfo : IUnknown, INoticeSource IPersist : IUnknown IPersistStream : ...
ZivDero's user avatar
  • 21
0 votes
0 answers
42 views

Why a breakpoint works in x64dbg but not in IDA?

I've spent all morning trying to find a solution to debug with IDA the same function I'm debugging in x64dbg. In x64dbg, I just go to Symbols -> ws2_32.dll -> WSARecvFrom -> F2 (set ...
kuhi's user avatar
  • 161
0 votes
0 answers
46 views

Debug Linux Kernel ARM64

I need to extract Initramfs from the kernel. The initramfs archive itself is encrypted and located inside the kernel. I couldn't extract the key. I thought to run the kernel in Qemu, connect with the ...
Ren's user avatar
  • 1
0 votes
0 answers
27 views

How can i generate function call tree in IDA & proper disassembly from obsucated flow?

I'm trying to properly disassembly the following code in IDA but failing to do that because code flow is obfuscated with call / jnz byte ptr [eax-2] how is it supposed to look like for IDA? .text:...
M. Sol's user avatar
  • 1
0 votes
0 answers
44 views

IDA can't load DLL, possibly packed but how?

I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading: So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
HeckMeck's user avatar
1 vote
1 answer
94 views

Where is IDA getting this symbol?

I'm currently researching how a certain malware works and patches some stuff in a certain Android's library. Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
Arget's user avatar
  • 13
0 votes
1 answer
82 views

IDA Pro could not disassemble native function properly

Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly): Is it possible to produce manually more readable assembly?
AseN's user avatar
  • 161
0 votes
1 answer
83 views

Patch all calls to a single function using IDC

I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand ...
flying_meatball's user avatar
0 votes
2 answers
110 views

How to change default pointer size in IDA Pro

so, I'm writing a script to automate analysis, and the code I'm working with is 64bit. the pointer size field shown here is the wrong one: I want to change it from within python to 64bit. I've ...
serv0's user avatar
  • 21
0 votes
0 answers
36 views

Compiler settings for show main func in IDA

Why in dissasemble code in IDA, some programs have func "main" in begin (in start window in IDA) like this: cseg01:00038460 ; =============== S U B R O U T I N E =============================...
black4's user avatar
  • 331
0 votes
0 answers
51 views

(IDA/Windbg) break after run

I want to break/debug/stop execution on the first line just after I run/go. So, in other words, I debug a executable with a dialog box and a command button. I wait for the program to load the dialog ...
Uddie's user avatar
  • 1
1 vote
0 answers
76 views

Is it possible to run Ida pro in a docker container?

I've got a script that runs IDA pro on a file, the problem is that I need to run that script in a windows docker container. I've got the script working fine, but I can't get the program to run in the ...
Anthony's user avatar
  • 11
0 votes
1 answer
78 views

IDA breakpoint condition

How to set breakpoint condition that checks certain address value, for example: 0xD526C122 = FF. How can I make a counter that counts how many times breakpoint condition was met without actually ...
morkovni's user avatar
0 votes
0 answers
56 views

How to fix IDA not automatically updating the graph layout?

I installed IDA Free 8.3 and found that, unlike older versions, it doesn't automatically update the graph layout when I make a change. Say I have the following node: If I add a comment, I get this: ...
Matthew Hinson's user avatar
1 vote
0 answers
58 views

Why does IDA give variables a different name in Assembly and Pseudocode?

Why does IDA give variables a different name in Assembly and Pseudocode? In the picture below, you can see that IDA gives the stack location -38h the name var_38 in the Assembly view, but in the ...
Daniel's user avatar
  • 161
0 votes
0 answers
18 views

Is there a way to have multi-level key binds in IDA?

For example, in Visual Studio we can have 2-level key shortcuts: Alt+E,F to format selection, for example. In IDA when I press record and press Alt+E,F, it does record it, but the action is triggered ...
KulaGGin's user avatar
  • 356
0 votes
0 answers
73 views

Reverse engineering Objective-C blocks

I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
jony cachez's user avatar
0 votes
0 answers
57 views

Need SOME help decrypt xxtea encrypted Lua file from cocos2D game LIBRARY

iam trying from a while to figure out the key this cocos2dx game but couldn't figure it out if someone could abit help with the way to find these keys you check the the file from here https://github....
SHADOWDIANA's user avatar
0 votes
1 answer
73 views

Unable to run system Save As dialogue while debugging Notepad with IDA

I am trying to hook a function to Notepad.exe, so that it will encrypt a file when saving. I have dis-assembled it with IDA. I want to place breakpoints on the saving subroutine which I have ...
Yizhar Amir's user avatar
0 votes
0 answers
184 views

resolved IDA I get a warning "7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160)"

when trying to debug an application with IDA, I get the following warning: 7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160) After clicking Ok, I am taken to the kernelbase.dll line ...
Dan's user avatar
  • 1
0 votes
0 answers
47 views

Need help when reading .sam file of cocos2D game

so recently I tried to reverse a dead game apk to get their animation cause it's so unique that me and my friend want to remake it. But it took so long to just take each part of the image and combine ...
NoName's user avatar
  • 23
0 votes
0 answers
62 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
Ray's user avatar
  • 1,083
0 votes
0 answers
70 views

decode lua files cocos2dx and protected from Frida and IDA64 for hooking

I want to decode the lua and other resources files. But i cant find the key when i use frida or ida 64 it crash before the game start. Game is here https://megamonglobal.com/ https://imgur.com/88Habwu
xbuyk987's user avatar
0 votes
0 answers
66 views

Import function symbols from a reflection system into IDA

I'd like to import structs and functions from a reflection system into IDA. The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
KulaGGin's user avatar
  • 356
0 votes
1 answer
85 views

When parsing a C header file in IDA, is there a preprocessor symbol I can use to detect it?

IDA has the ability to parse C header files (by now a secondary option based on Clang also exists). It is useful to get structs and enums into your database via the Local Types view. Question: Aside ...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
298 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
R4444's user avatar
  • 1,807
0 votes
1 answer
69 views

My ida.reg file got deleted, is there any way to restore ida?

I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed - Is there any way to restore ida? ...
R4444's user avatar
  • 1,807
0 votes
0 answers
58 views

IDA Free Debugger slows down app substantially

I'm using IDA Free to decompile and debug an exectuable (a game, actually). When starting the debugger, the game runs really, really slow occasionally. Before, I have used Cheat Engine to debug the ...
Daniel's user avatar
  • 161
1 vote
0 answers
101 views

How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?

I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
LyZeN77's user avatar
  • 11
3 votes
1 answer
416 views

convert a memory location to string in Ghidra

I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well. I would like to have a decompiled pseudo-code in Ghidra like: ...
Iman Abdollahzadeh's user avatar
0 votes
0 answers
231 views

How to decrypt xxtea encrypt lua file from cocos2D game

I'm trying to decipher this game because it's about to be discontinued I tried to decompile the apk looking for image resources and lua files. Looking at the received title I guess that the game was ...
Neit's user avatar
  • 41
0 votes
1 answer
150 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
Edward Winch's user avatar
1 vote
0 answers
63 views

After loading additional files into an IDA database: can I process it, including applying PDB etc?

After loading an additional binary (.dll) file into an IDA database, is there a way to run it through a similar routine as would happen if the DLL had been loaded standalone? What I am aiming for is ...
0xC0000022L's user avatar
  • 10.9k

1
2 3 4 5
43