Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
0
votes
0answers
45 views
IDA doesn't see code
I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
46 views
Resource Hacker and IDA PRO
How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH).
e.g. I find, in RH the following Menu items:
POPUP "Painter"
{
MENUITEM "Start/Continue", 32840
...
3
votes
1answer
36 views
Load .IDL / TypeLib into Ida Pro
I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool).
Is there a way to load the ...
1
vote
1answer
48 views
What is ObjectStublessClientXX in ole32dll?
When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll .
What is that function? What does it do?
Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
47 views
IDA PRO - .id0: b Tree error: file open error: permission denied
Many times after closing a file I am working on and trying to open it later I get an error:
<fileName>id0: bTree error: file open error: Permission denied
even when i copy this file to a new ...
1
vote
0answers
71 views
Trying to identify block of code which generates 256 bit key
I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted.
I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
1
vote
1answer
40 views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
0
votes
0answers
40 views
Does anyone have experience with ida DECOMPILER (not disassembler) for 64 bit? Is it worth $3k? [closed]
It’s hard to find reviews or any info on the 64 bit decompilier. Thanks!
0
votes
1answer
62 views
When to create a keygen versus when to bypass the security jumps
I am a newbie reverse engineer.
I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
-2
votes
0answers
55 views
PIE bypass in /system/bin/linker [closed]
I tried to remove PIE error from my linker by this manual, but I can not find "data xref" line near this error. What to do?
.rodata:0000B1F9 aErrorOnlyPosit DCB "error: only position independent ...
-2
votes
0answers
33 views
Is it can expand? , IDA Locals menu
I want to find a specific value in locals. (Child of context)
But the context is too deep , So, is there any way to automatically expand it or extract it with csv?
1
vote
0answers
31 views
Can't trace MIPS embedded device remotely
I'm trying to debug a remote device using gdbserver and IDA Pro.
I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
0
votes
1answer
85 views
How to watch communication between 2 processes?
I have exe file in my pc(exe1) that send message to another exe (client-server maybe).
I dont know which exe recived this message from exe1 and with which iso that message encoding.
How can I see ...
1
vote
0answers
27 views
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
1
vote
1answer
72 views
FLIRT Signature Applied, IDA shows references but no auto rename?
So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this:
Which I am understanding that somewhere in this program they have statically linked a Lua C or ...
2
votes
0answers
34 views
Show parameters stored in stack with __fastcall in IDA
This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention.
mov [rsp+32], rdx ...
1
vote
1answer
71 views
Data moved after program rebase
Consider the following piece of code:
.text:00F74B42 call sub_12D1130
.text:00F74B47 mov eax, dword_15A0C80
Now, I want to add a sanity check but as I don't have enough space to do that I ...
1
vote
1answer
75 views
Why doesn't IDA break on the WriteFile function?
I searched all places in IDA that call the imported WriteFile function and put a breakpoint on them.
But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not ...
5
votes
1answer
81 views
What's the meaning of dword_XXXX and offset dword_XXXX in IDA?
Consider the following code:
In C++:
SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized
void someFunction()
{
globalPointer->...
0
votes
0answers
65 views
How to debug 1 step after click on button?
I am debugging an executable file with IDA and put a breakpoint at the place that I see 2 buttons.
I want to know which function is executed when I click on one of the buttons and witch one is ...
0
votes
1answer
26 views
What is the difference between xrefs and stack trace?
In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace.
What are the differences between them?
How does IDA know what the stack ...
3
votes
2answers
60 views
IDA function never called and only cross-referenced as data
When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions.
There is no another place that ...
0
votes
1answer
40 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
0
votes
0answers
42 views
The value of edx register
Upon trying to reverse a keygen i came across some assembly in IDA that i didnt quite understand.
mov dl, String
In the above code, String if a buffer in memory used by GetDlgItemTextA function
...
0
votes
1answer
69 views
Keygenme - Key location
So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction:
...
2
votes
1answer
27 views
How to change immediate to reference using IDA API?
i.e. What is the IDA API equivalent to pressing 'O'?
-1
votes
1answer
39 views
How to use Python while debugging in IDA
I'm debugging an .exe file in IDA.
At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file ...
2
votes
2answers
84 views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
1
vote
1answer
29 views
What are these LOAD segments in an assembly ELF64?
I wrote the following (fasm) assembly program:
format ELF64 executable
segment readable executable
include 'io.inc'
include 'unistd64.inc'
entry main
main:
mov rdi, msg
call print
call ...
3
votes
2answers
86 views
Why doesn't this retn instruction return from the function?
I disassembled an exe file on Windows with IDA and saw this function prologue:
I see that when the retn executes instead of returning it jumps to sub_1314cba4.
Why doesn't the retn instruction ...
1
vote
1answer
53 views
How debug process that not started with ida? [duplicate]
I am trying to debug two different exe files,in windows.
The first exe launches the second, and the second exe doesn't work well unless the first starts it.
I want to be able to debug the second exe....
0
votes
1answer
65 views
Installed IDA 7.0 Freeware — no debugger, is that installed separately? [duplicate]
After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
1
vote
0answers
45 views
Trace back Offset Function
I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position.
Thanks!
Offset ...
0
votes
2answers
69 views
How to breakpoint exe tcp packet
I am debugging an executable in windows with IDA.
My exe sends a TCP packet and I want to see which function it uses to send the packets.
I looked on the import tab and haven't found any function ...
2
votes
1answer
83 views
How to find start of .text section?
i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it ...
1
vote
0answers
69 views
IDA fixups, why and how
I'm using IDA 7 Freeware, not Pro. I've been using IDC to re-invent the wheel somewhat, but I'm learning a ton of stuff as I go along.
I have a 16-bit MSDOS exe which I'm reversing. I stripped out ...
2
votes
1answer
74 views
Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?
I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened it with ...
0
votes
0answers
70 views
How do I obtain database key in IDA pro/Hex RAYS from decompiled .SO lib?
I'm new to reverse engineering and I found a .SO library inside an android app. I wanted to reverse engineer it to find the key used to encrypt the local database that the game uses for characters. ...
1
vote
2answers
91 views
Lea instruction on datasegment
I wrote simple program(was built in release mode(x86)) to practise re skills but I can not understand one part of it.
C++ program:
int doSub(int a, int b)
{
int result = a + b;
result -= 2;...
1
vote
2answers
86 views
How to stop debugging while a specific value is on the stack?
I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF .
That value interests me, I want to know where this value comes from, how it gets pushed onto ...
1
vote
1answer
57 views
How to see all my comments on idb file
I add some comments to exe file with ida(save on idb).
Is there any simple way how to see all my comments in 1 windows?
0
votes
2answers
62 views
How to refer to the same call on separate IDAs
When I open an .exe file in IDA, each time I get a different function address because each time I get a different base address offset.
So if I open an .exe file with IDA and want to tell a friend "...
1
vote
1answer
63 views
How to find the executable code of the native method in the library * .so? (Android)
I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
1
vote
1answer
50 views
IDA - Remote debug on linux
I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink).
Because the exploit is via gets() I try to pass input through the "...
0
votes
0answers
46 views
IDA crashed , and damaged my idb file
I have idb file that I changed function name and add lot of comments.
Suddenly my ida process crashed and when I want to start IDA with my idb file (to see all my db ) I not see any function on ...
-2
votes
1answer
63 views
How to install ida plugin to identify encryption function
I saw here How to identify known encryption algorithm? the IDA plugin https://github.com/nihilus/IDA_Signsrch
I don't understand how to install it .
In the INSTALL I saw coppy the plug-in and ...
3
votes
0answers
42 views
how to calculate max possible stack size utilization
Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython?
currently my best approach is iterating through all functions and counting stack-...
3
votes
1answer
60 views
Resolving FLAGS bits with IDA
While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
0
votes
1answer
47 views
Figuring out where 2 executions of the same process differ
I have a process that runs and does it's job sometimes (takes some files and does some work). However when I feed it some incorrect files, it fails. I'd like, if possible, to record every step the ...
2
votes
1answer
52 views
Ida break point on address changed
How can I set break point when the value on specific address is changed while I debug it with ida
