Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
0
votes
0answers
31 views
IDA Hex-Rays: There are no xrefs to
I defined a new type and changed the function signatures and local variables in the Pseudocode window so that they use this type. But IDA itself displays this type as unused. She did not see ...
0
votes
1answer
59 views
How can I make IDA understand this switch statement with a signed jump table?
I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0:
int main() {
int a = 0;
for (int i = 0; i < 5; i++) {
switch (i) {
case 0:
a = 1;
break;
...
0
votes
0answers
29 views
IDA SDK: How to add a struct (pointer) field to a struct?
I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows:
00000000 SomeClass struc
00000000 ...
1
vote
2answers
55 views
Get Multiple Function Names for One Address in IDA
I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
1
vote
2answers
89 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
2
votes
1answer
86 views
IDA does not create Vtbl structs for child classes loaded from PDB
I'm decompiling a MFC 4.0 application, and now loaded the MFCS42.PDB from the MFC 4.2 source into IDA 7.0 (not having the MFC 4.0 source) to make it create the appropriate structs representing the ...
0
votes
0answers
24 views
How to start remote debugging in IDA Pro use IDC or IDAPython?
IDA Pro has remote debugging function. Some parameters are invisible characters and cannot be copied into the “parameter” edit box. So I want to start remote debugging with IDC or IDAPython.
Do you ...
0
votes
0answers
24 views
IDA FLIRT signatures for externs?
I have a simple bit of code, that's invoking OpenSSL. Disassembly shows an expected call;
int __cdecl BN_bin2bn(int a1, int a2, int a3)
{
return BN_bin2bn(a1, a2, a3);
}
Which points BN_bin2bn to ...
0
votes
0answers
41 views
Adding new type libraries in IDA
While I'm reversing a binary, I found out that the binary is dynamically loading a GetHashFromFileW function from mscoree.dll, using LoadLibrary and GetProcAddress.
The type information of this ...
0
votes
0answers
33 views
Debugging two DLLs simultaneously in IDA
Having read How to debug the DLL of an EXE using IDA Pro, I know how to debug a DLL as called by an .exe.
I have an '.exe' file that uses two distinct DLLs. How can I open both DLLs at the same time ...
0
votes
0answers
22 views
Is it possible to change image base with `IDC` in IDA?
I use IDA ARM remote debugger with Android native libraries, and it detects wrong image base address always. I have to go to Segments => Rebase Program, and set Image base value to correct one on each ...
0
votes
0answers
30 views
View XMM registers in IDA Pro while debugging
How can I view the XMM registers in IDA Pro?
While debugging, I can only view the default registers and eflags. Is there a way to view the XMM registers, xmm0 to xmm7?
Thanks.
0
votes
0answers
28 views
Execute till User in IDA ?
In OLLYDBG I can do Execute till User with Alt+F9
How can I do it with IDA?
0
votes
0answers
26 views
Assemble function of IDA Pro not working properly
I am using the Patch Program option of IDA Pro to edit the assembly of a binary at runtime.
When I enter the following instruction:
mov rax, [rsp + 0x48]
I get an "Invalid operand" error from IDA ...
0
votes
0answers
26 views
Getting function arguments with IDA: When do function prototypes exist?
This post explains how to get function arguments using idapython.
However, I read here that get_arg_addrs() requires the prototype of the called function to be present.
My question: In which cases ...
0
votes
0answers
23 views
IDA/bochs: incorrect segment bitness
I'm trying to run a piece of 16-bit code in IDB mode, but when I run it, Bochs (2.6.9) tells me "incorrect segment bitness". The only segment is marked as 16-bit real mode.
Could someone please ...
0
votes
0answers
42 views
How to remove all goto statements in pseudocode?
IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...
2
votes
1answer
59 views
How to load firmware x86 BIOS into IDA Pro 7.0
I have a file called bios.bin which is the firmware of an ATM machine and I have found out it is x86 code 16-bit. But I don't understand how I'm supposed to set the base address in IDA Pro for an x86 ...
0
votes
0answers
30 views
IDA Pro idapython miss to recognize the functions?
When I use the above idapython script to output all functions which belong to '.text' segments, it is missing some functions. For example, from the screenshot, the script will miss the function "...
1
vote
1answer
62 views
While loop function disassembly x86
I am trying to convert this binary to C but I am having trouble with the while loop. What does
sub esp, 8 mean? as well as push [ebp+_a] ? I am able to get the esp 8 sometimes while changing the ...
0
votes
1answer
37 views
IDA remote linux Debugger attach to a running process
I usually use remote linux debugger as shown below:
./linux_server bin
And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
0
votes
0answers
20 views
IDA - Changing unknown data to a numerical value
I am a beginner to the whole reverse engineering scene so please do excuse any ignorance of mine.
How would I change data defined in a segment (see image below) to a value?
Thanks a bunch.
0
votes
1answer
48 views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
1
vote
0answers
63 views
API to force reanalyze of function (Alt-P)
Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml)
Is there a way to do this through API?
0
votes
0answers
43 views
SteamSDK Hijacking CreateLobby
I've figured out most of the logistical stuff, however now I'm getting hiccuped on this little issue.
I have injected my own DLL setup the Steam environment like I should, but now I keep getting the ...
0
votes
1answer
60 views
How to run ida in windows xp
I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application.
I search and found that IDA is not supported with Windows XP.
How can I run IDA ...
1
vote
1answer
24 views
idapython cfunc_t.treeitems always empty
I am using the hexray api to get all the items of the AST tree (the ctree) obtained by decompiling a function.
Unfortunately, the treeitems vector is always empty. Specifically, the function paaaa in ...
-1
votes
1answer
40 views
Gdbserver and idapro
I would like to reverse a file so of an apk using idapro (on windows) and gdbserver(on remote target device) . I arrived until the attach of the running process. But after? Is there a tutorial ...
1
vote
0answers
64 views
Reverse Engineering Linux Core Dump
I have a Linux Core Dump file for a binary (which apparently crashed during execution)
file command on the core dump:
core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
2
votes
1answer
59 views
Why IDA can't find the function named by windbg
This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like
SERVER+0x78123
When I return back to IDA to see the code ...
1
vote
1answer
70 views
Why is the RH850G3K processor missing in my IDA?
Why there aren't RH850 series(like RH850G3K) processors in the processor type list in my IDA? (IDA website says they are supported)
I use IDA Pro 7.0
2
votes
1answer
84 views
Is there any way to export breakpoint with IDA Pro?
As the title describes, I'd like to export breakpoints in IDA Pro and load from another project. Is there such feature?
1
vote
1answer
73 views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
0
votes
0answers
37 views
IDA Pro debugging on OS X
Is there some trick to getting debugging working on OS X with IDA? I've tried a number of different approaches, and a number of different apps, but no matter what I do, either I get SIGNINTs or ...
3
votes
1answer
114 views
How can I get the byte size of an operand in IDA Pro?
I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
1
vote
1answer
57 views
Bp on memory access in arm deb
I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
3
votes
1answer
84 views
IDA 7.0 - combine sequence of assembly instructions to a macro
I'm solving this CTF with IDA Pro 7.0.
At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it.
The main problems are:
the ...
0
votes
0answers
26 views
How to use idat.exe in Ubuntu server？
wine /home/kappa/Desktop/IDA/IDA_Pro_v7.0_Portable/idat.exe -A
-S'/home/kappa/Desktop/IDA/IDA_Pro_v7.0_Portable/idc/1.py /home/kappa/Desktop/1.txt' /home/kappa/Desktop/busybox
When I use the above ...
0
votes
0answers
33 views
Regenerate graph view after block size modifications
In IDA 7.0 freeware, in graph view, I added multi-lines comments on a block. The upper block was then "leaking" on the lower one. So I moved the blocks to see all the code.
By moving the blocks, I've ...
0
votes
1answer
80 views
Searching for a sequence of bytes in IDA
Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now.
I first looked in the import table,...
3
votes
0answers
58 views
IDA Pro's debugging - Stack view , Register values and ASCII decoding
Below questions are related to IDA Pro debugging:
1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
1
vote
0answers
28 views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
0
votes
0answers
48 views
Multiple decompilation failure with ntoskrnl
IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that:
I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm....
0
votes
0answers
48 views
IDA PRO - Error loading the trace file
When i try to load a trace file, after saving it i get this message:
Error loading the trace file ... failed to unpack trace event #3
I run a trace, save it and then load it and i still get this ...
2
votes
2answers
104 views
Remote Debugging Linux Binaries - Stack Address Changes?
Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro?
I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
0
votes
0answers
36 views
Passing input to program in Remote Debugging with IDA Pro
I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
6
votes
1answer
168 views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
0
votes
0answers
48 views
IDA Hex-Rays turns __cdecl into __usercall
IDA 6.8 + Hex-Rays
Plugins: HexRaysCodeXplorer, HexRaysPyTools
I am faced with strange things.
// Before
int sub_406350()
// After
int __usercall sub_406350@<eax>(int a1@<ebp>)
// ...
1
vote
1answer
51 views
Unable to resolve the symbols for a statically linked binary in IDA Pro
I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected.
I generated the sig file for libc on the Linux machine on which the program ...
0
votes
1answer
92 views
IDA Pro is showing Function names for a Stripped Binary
I have an ELF 32-bit binary and it is a stripped binary.
Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is ...
