Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,330
questions
0
votes
0answers
2 views
Split IDA segment into sub segments
I'm reversing a firmware, that comes in one big binary chunk(.bin file).
After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
1answer
19 views
Exported DLL function has only stdcall with some offset
I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this:
IDA pseudocode:
int __stdcall ...
0
votes
1answer
28 views
Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro
Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis.
cseg04:3044 loc_105D4: ; ...
0
votes
1answer
34 views
Why won't IDA let me name this variable?
I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it.
The name didn't propagate over to the program, as you can see in the mov ...
0
votes
1answer
23 views
Confused about address being referenced
lea ebp, dword_403638
lea ebx, [ebp-4]
mov edi, ss:[ebx]
I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
0
votes
1answer
27 views
Building micro controller memory image in IDA
I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format.
Some relevant information from the datasheet:
...
0
votes
0answers
18 views
IDA taking forever to run autoanalysis on remote Android app?
I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
0
votes
1answer
22 views
Save ida64 database as 32-bit
I accidentally ran ida64 on a 32-bit binary so I can't use the decompiler. Can I save it as a 32-bit database so I can open it in ida?
1
vote
1answer
35 views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
1
vote
2answers
67 views
Dealing With x86 Segmentation Overlaps
I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly.
I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
0
votes
1answer
23 views
IDA Pro jump to offset of DWORD
I have the following instruction in IDAs Decompiler:
result = data[3 * a1] + ptr;
and would like to know what is at the position if a1=60.
So I have to look at data[180]. Unfortunately all I see ...
0
votes
1answer
90 views
Weird IDA/Decompiler floating point output
I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before.
// a2 is always 60.0
void some_function(struct_123 *this, float a1, float a2)
{
...
0
votes
1answer
66 views
IDA 7 not dissasembling NEC v20 code
So I have an embedded machine from the late 80s I want to mess around with. It uses a NEC v20HL which is an 8088 compatible with some extra 80186 instructions tossed in. I know it uses 64k code ...
0
votes
0answers
128 views
how can i decrypt huawei HG531s v1 config file?
I have tried to follow this guide but
libxmlapi.so didn't have the required ATP_GetInfo1 function
so i moved to the next file libhttpapi.so
it had
ATP_GetInfo1
ATP_GetInfo2
ATP_GetInfo3
...
1
vote
2answers
114 views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
2
votes
2answers
71 views
How can I pass input to my program while debugging it with IDA
I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
0
votes
1answer
68 views
Identify function in cpp static binary
When I open cpp static binary, how can Identify known function like fopen/ioctl/printf ? They compile statistically into binary
I dont know the compiler of this binary .
2
votes
1answer
72 views
Finding address in IDA from address found in Cheat Engine
I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
0
votes
0answers
45 views
Decode message in esoteric audio file
I'm having a reverse engineering lab at school and my last project is to beat a 10 level reverse engineering CTF-like challenge. It's got plenty of interesting things. What I need to do is find a ...
0
votes
1answer
66 views
IDA freeware (v7.0) exporting Hex-View A
I'd like to export the Hex View generated from IDA to a file with the addresses intact similar to the .LST files generated for assembly instructions.
The closest I've come to generating this file is ...
0
votes
1answer
62 views
IdaPython aob search and rename example
Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying ...
1
vote
2answers
104 views
Can't find any string with IDA, why?
A friend asked me to make some small mod on a app.
The mod should be to rewrite some labels like button, textbox text into his
language, so he can better understand the app...
I loaded the app to IDA ...
0
votes
0answers
85 views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
0
votes
1answer
50 views
How to call WinApi from a breakpoint in IDA Pro?
When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):
//C++ code
SCROLLINFO s;
s....
0
votes
1answer
46 views
Search string in all binary pesudo-code
How can I search pesudo code string in all functions in binary with Ida??
Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c)
I want to search for example where ...
1
vote
0answers
51 views
How does IDA provide function names to dynamic calls?
I'm trying to compare a binary (a basic hello world exe compiled with MinGW) within Immunity Debugger and IDA. In Immunity I notice a call to EAX which points to 004019c0.
Looking in IDA I notice ...
1
vote
1answer
40 views
IDA Copy structure from one database instance to another
This question sounds rather simple, but I can't seem to find any option for this.
I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
2
votes
0answers
47 views
How to return a list of vtable methods?
I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
1
vote
0answers
31 views
IDA Pro Reset All Stack Pointers to Default
Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary?
...
2
votes
0answers
98 views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
1
vote
0answers
39 views
How is sprintf() identified by IDApro? [closed]
#include<stdio.h>
int main()
{
char buffer[50];
int a = 10, b = 20, c;
c = a + b;
sprintf(buffer, "Sum of %d and %d is %d", a, b, c);
// The string "sum of 10 and 20 is 30" ...
2
votes
2answers
90 views
GetProcAddress with 0 as lpProcName
I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.
The binary is a 10 level reversing game where you get ...
1
vote
1answer
38 views
Find out if address store in heap or stack
While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value.
How can I know if this address allocated in stack or in heap?
0
votes
1answer
125 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1
vote
1answer
40 views
MEMORY macro in IDA Pro pseudocode
I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example:
int S_u8init_flag = 0; // ...
1
vote
0answers
65 views
Using IDA to find pointer passed to procedure
Loading the source into IDA, I have this function:
According to the source for Lua, this function should be passed a pointer to the Lua_State struct:
LUA_API int lua_gettop (lua_State *L) {
return ...
2
votes
1answer
122 views
Is this really a function IDA could not decode?
I have the following IDA output:
BEGTEXT:00415A2C read_dpc_sub_415928 endp
BEGTEXT:00415A2C
BEGTEXT:00415A2C ; ---------------------------------------------------------------------------
BEGTEXT:...
0
votes
0answers
37 views
what is Ida Name Tab
I know what is Function tab (show all function) and what is String tab(show all string) and Import , Export ....
But what is Name tab? what should I expect see there? and how Ida get this information ...
0
votes
0answers
50 views
idapython - Scan all possible code paths between start and end addresses
I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
25 views
Changing a string pointer while debugging
I'm facing an issue, and I'm not sure what is the best way to handle it.
While debugging a program (x64, windows), the program copies certain string using
errno_t strncpy_s(char *restrict dest, ...
0
votes
1answer
87 views
How to find out address in binary file (like IDA) with python code only?
I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
0
votes
1answer
103 views
Ida - what is Parse C header file
In ida File->Load file there is option Parse C header file, I want to understand that .
If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
0
votes
0answers
31 views
IDA remote debugging - non printable characters in parameters
I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course.
My goal is the ability to debug with IDA the process with the ...
0
votes
0answers
63 views
IDA change string in rdata
This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php?
toquizwammer.github.io
Thanks.
0
votes
0answers
25 views
Changing pseudocode based on FPU fmul behaviour
A 3D software was compiled in which a typical x/4096f was translated as:
fmul ds:f4096
where f4096 equals to: 0.00024414062
Example decompiled pseudocode as-is:
skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
95 views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
115 views
0
votes
0answers
129 views
How to run python script in IDA PRO after each breakpoint?
I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error.
I'm trying to find something like '...
2
votes
1answer
102 views
IDA “unk_XXXXXX” meaning? [duplicate]
I am new to reverse engineering.
Today when looking at IDA, I found this
if ( *(_UNKNOWN **)(this + 8) == &unk_4EDC58 )
but I dont understand the part "unk_4EDC58".
So can you help me ? Thank ...
0
votes
0answers
19 views
use ida python to add a remark when calling a function using register
I want to add a remark for all non direct function calls.
e.g. say i have
mov EAX [functionEP]
call EAX
Assuming i have many such calls to various functions, I would like to run the debugger and ...
