Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
-1
votes
0answers
32 views

Will ida pro have the following features?

First of all, I'm sorry if it's not smooth because it's a translator. I am checking the value of a specific variable using the “watch view” of ida pro. I want to see all the data as a hex string(in ...
0
votes
0answers
25 views

Lexer and parser for .asm file produced by objdump

Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
0
votes
1answer
54 views

Find out the name of constants and var in IDA pro

I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I ...
0
votes
1answer
55 views

How to inform Hex-Rays decompiler (7.0) of known register values?

I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
0
votes
1answer
59 views

what is Off in IDA Pro?

probably silly question, what does Off ... means in IDA Pro? i markered the snapshot as an example.
0
votes
0answers
40 views

how to get all “called functions” in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
0
votes
1answer
30 views

Problem when opening a script file in IDA (syntax error)(pe_sections.idc)

I downloaded the script files from http://www.openrce.org/downloads/details/57/PE_Scripts. Then i extracted the files in the folder idc in the IDA folder (C:\Program Files\IDA 7.0\idc) I opened IDA (...
0
votes
0answers
47 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
2
votes
1answer
60 views

WinDBG doesn't resolve function names when debugging kernel module

I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically). Here is a picture ...
0
votes
1answer
33 views

How to run a process with high privileges using remote debugging

I am using remote debugging with IDA. The target and host machine are Windows. I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
1
vote
1answer
62 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
0
votes
0answers
21 views

ida: a better way of printing ida script output on console

I just started exploring ida. I have a simple IDAPython script. import sys import idc import idautils # wait for auto-analysis to complete idc.auto_wait() for ea in idautils.Functions(): print(idc....
0
votes
1answer
68 views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
0
votes
1answer
49 views

A bit confusion with cheat engine function address and IDA subrutine

I have found a function with Cheat Engine that I like to show in IDA:enter image description here but the function is not present in IDA. Probably I have a bit confusion becouse I don't have ...
1
vote
2answers
49 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
0
votes
2answers
49 views

Order of arguments in __usercall

i have the following function with five arguments: ; int __cdecl trampolineRegister(void) a4= dword ptr 8 a5= dword ptr 0Ch push ebp mov ebp, esp add eax, ...
0
votes
0answers
57 views

A way to detect a anti-cheating system

I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script: debugProcess() -- Attach ...
0
votes
0answers
68 views

IDA IDC script does not seem to work

I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
0
votes
0answers
41 views

How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
0
votes
0answers
42 views

Address register offsets and analysis (Tricore)

I'm decompiling a binary file for a Infineon Tricore processor, the code is incomplete and only contains part of the code so will not execute. The auto analysis did a great job and the code is ...
1
vote
2answers
91 views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, std::...
1
vote
0answers
55 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
0answers
16 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
-1
votes
1answer
121 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
0answers
23 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
0
votes
1answer
27 views

Can't find sequence of bytes in IDA while debugging

While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44: I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
0
votes
0answers
51 views

How to reverse engineer structs

I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
0answers
17 views

IDA, wrong jmp operand after patching

I'm writing a python script for IDA to automate the deobfuscation of a binary. After patching with a jmp instruction ida provides the following disassembly: .text:008FD01E jmp ...
-1
votes
1answer
58 views

IDA decompile binary file

how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
1
vote
1answer
62 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
0answers
21 views

in ida pro 7+, what is the way to get a list of applied functions by signature?

I can only see the number of applied functions, but not the full list. In the function window, there is no way to differentiate which signature lib is applied
0
votes
1answer
41 views

Packer changed memory in IDA?

I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it,...
0
votes
0answers
25 views

IDA - tracing strings

Is it possible for IDA to save string/memory content pointed by one of the registers during run-time?
-3
votes
1answer
156 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
0
votes
1answer
72 views

What is the meaning of ARM LDAXR/STLXR instructions?

Often while disassembling ARM files, I see some code snippet with the following pattern: loc_BB30: .text:C0 FE 5F 88 LDAXR WZR, W0, [X22] .text:00 04 00 51 SUB W0, W0, #1 .text:...
2
votes
1answer
46 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
-1
votes
1answer
63 views

What does xchg means when accessing array element?

I have ASM code of some Windows *.exe in IDA: mov rax, [rbx+10h] mov ecx, edx xor edx, edx xchg rdx, [rax+rcx*8] Which is decompiled to pseudocode to _RAX = this->m_someMemoryPool; ...
0
votes
0answers
24 views

C166 Memory and Addressing mode

Here I think I have some wrong in base concepts, In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5. So, we ...
0
votes
1answer
42 views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
0
votes
0answers
24 views

How does Andriod .so files Reverse Engineering with a dissasembler like IDA pro and Cutter work

So few days ago going through youtube Reverse Engineering videos, i came across a particular video where an android application was modified using IDA pro by disassembling it's .so file found in /lib ...
0
votes
0answers
28 views

Doubts about a pointer in a DLL

I am working with the dll of a software in which I am not with access at the moment, analyzing the source code in static analysis tools, I realized that it receives a pointer as one of the parameters, ...
0
votes
1answer
55 views

Cant recognise where is my targeted function executed

Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here: if (...
0
votes
0answers
14 views

How to get the color of a operand in IDApython?

Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
1answer
56 views

What is the use of moving a variable 3 times only to pass it back to the original register, with no calculations in between?

I'm reverse engineering a C++ binary using IDA, and there's one function that I don't quite understand. x = dword ptr -8 var_4 = dword ptr -4 push rbp movss rbp, rsp sub rsp, 10h movss [...
0
votes
0answers
79 views

C166/C167 code analyzing

Recently I try to reverse piece of assembly code that written for C166/C167 Arch. But I have a problem with some places for convert to C code, such as: loc_1892: mov r9, #4 add r9, r0 mov ...
0
votes
0answers
18 views

Get the string usage sequence in each function with Idapython?

The only function i know for this task is idautils.Strings() but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...
0
votes
0answers
29 views

Checking if a call is a API/Library call in IDApython?

I asked the question a while ago but found no answer so I'm trying my luck again the only solution is this : Finding all API calls in a function but it doesn't work when the library call is a .NET ...
0
votes
0answers
37 views

IDA debug Android native app receive SIGPWR signal cannot resume

I'm trying to debug an Unity game app mono. First i use frida to spawn app launch and attach app pid, second i pause app process,and then i run android_server with IDA take breakpoints in, finally ...
2
votes
1answer
122 views

Can I use python3 with IDA 7.0?

Got IDA Pro 7.0 (I can't update at the moment), I'm currently unable to use idapython. I have python3.8 installed on my machine and nothing else (I dont want any collisions). How can I use make ...
1
vote
2answers
228 views

Batch decompile using IDA Pro 7.5

I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch ...

1
2 3 4 5
33