Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,997
questions
0
votes
0
answers
12
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
0
votes
2
answers
58
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
1
vote
1
answer
43
views
Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?
Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version.
Problem is i have to do it again cause there ...
- 23
0
votes
0
answers
24
views
Working with IA64 in IDA Pro
When disassembling IA64 code in IDA Pro when I try to open the Local Types window
i get an error:
Sorry, the current processor doesn't support the type system
- 130
1
vote
0
answers
26
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 41
1
vote
0
answers
32
views
Corrupted IDA database .i64 file (Empty Header)
Im my 10 years using IDA Pro this never happend.
I saved using IDA Pro 7.7 when I go to open today
I find out that IDA PRO didnt put header on file
If I try to open says "File .... is not an IDA ...
- 11
1
vote
0
answers
27
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
- 21
1
vote
0
answers
22
views
After jumping to a new segment, it warns "The memory could not be written"
I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that &...
- 11
1
vote
0
answers
57
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 31
4
votes
1
answer
240
views
How to make pseudocode in IDA more human readable
Some codes in IDA are not clear enough. Especially when they do reference after calculation
while ( dx33[rdi24] );
if ( rax35 != &WPP_GLOBAL_Control && (*((_BYTE *)rax35 + 68) & 2) !=...
1
vote
0
answers
15
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
- 111
2
votes
1
answer
43
views
Function pointer as struct field in IDA
I have following function:
void __thiscall ParsePackage_v5(package_t *package, stream_t *stream)
{
(*(*package->stream + 8))(package->stream, package, 4);
}
.text:0069F5A0 ; void __thiscall ...
- 23
1
vote
0
answers
68
views
How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?
I am looking at the following CTF challenge:
0x56555779 <+0>: lea ecx,[esp+0x4]
0x5655577d <+4>: and esp,0xfffffff0
0x56555780 <+7>: push DWORD PTR [ecx-0x4]
...
- 1,708
2
votes
0
answers
33
views
How to force IDA to show size of pointer dereference?
IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:
mov ecx, ...
2
votes
2
answers
117
views
Reverse function in .rdata field
I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll.
However, it appears in .rdata section in the .dll ...
1
vote
0
answers
62
views
How to call the Color Picker window in Ida Pro from a script?
I'm going to make a python script that allows you to color selected functions - in the right colors.
To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
- 130
0
votes
2
answers
81
views
How to use IDA pro to find ALL strings in an exe file?
I've been using IDA for some time and most of the time I can find the strings I am looking for in the String panel.
In one of the recent exe files I was working on, many string are missing, or not ...
- 9
2
votes
1
answer
53
views
How to create a function graph in IDA? Could not find grapher (Linux)
IDA (free v8.0 on Kali Linux) produces an error any time I attempt to create a graph, e.g. View > Graphs > Function Call:
Could not find grapher '/usr/bin/dotty'. Please check GRAPH_VISUALIZER ...
- 53
2
votes
1
answer
105
views
How to hide Remote Windows Debugger in IDA Pro?
Whenever I try to debug a 3D game through VMware and IDA Pro, an "access violation" pops up.
The error occurs in the body of the program after memory is allocated by the operator New.
...
- 130
1
vote
0
answers
30
views
Find an address of injected code via GetModuleHandleA
I am reversing really old game (20 years old).
l2.exe loads Dsetup.dll Network.dll. (not sure about order)
inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
- 111
1
vote
1
answer
38
views
Infer function parameter types from caller argument type in IDA
So i have the following code:
struct my_struct_t var1;
fun(var1);
I don't have the symbols for fun's parameter type but since it's called with an argument with type my_struct i would want IDA to ...
- 21
2
votes
0
answers
24
views
Find location to override PC by stack frame with stackoverflow
I have stackoverflow in MIPS arch (without ASLR/canary)
In Ida I see that the buffer that has the overflow located in SP+200
In the beginning if function I can see the stack size because I see the ...
- 91
1
vote
0
answers
69
views
Fail to load pdb file in IDA
I'm following this post to set my IDA symbol path How to configure IDA to load .pdb files from Microsoft public symbol server?
I added a system variable called _NT_SYMBOL_PATH with value SRV*\C:\...
0
votes
0
answers
27
views
RDATA Section Strings
I have been reversing a binary and trying to make sense of it, which is basically a go malware, there are lot of important strings at the .rdata section, but right now am not sure where this strings ...
0
votes
0
answers
65
views
What is the meaning of this message in IDA?
What is the meaning of this mmessage in IDA:
The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
- 13
0
votes
0
answers
43
views
IDA binary patch "has no file mapping"
I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to ...
- 1
0
votes
1
answer
45
views
ida pro: scripting debugger with python fails on step_over/run_to
So I am trying to run an app and collect information at certain points.
No biggie, right? Wrong. Check this simple example:
import ida_dbg
ida_dbg.step_over() #or runto()
eax = ida_dbg.get_reg_val(&...
- 403
0
votes
0
answers
58
views
Can someone help to understand code disassembly by IDA?
Can someone help to understand code disassembly by IDA?
Basically this use for calculate key from seed. Here I would like to understand the logic and also I would like to know what would be the output ...
- 1
0
votes
0
answers
26
views
Can anyone help to understand how Calli function work?
Can anyone help to understand how below function works?
Below is C# code which calls c++ dll function.
Utils.Conversions.GcStrToStdStr(accessMode, ref struct2);
_Common* nativeCommon = this....
- 1
0
votes
0
answers
42
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 13
2
votes
1
answer
191
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 23
2
votes
1
answer
87
views
Identify two structs in IDA
When decompiling an exe file, I have defined two structs struct A and struct B that are of the same structure. They appeared under different contexts, thus I assumed that they were different structs. ...
- 123
0
votes
1
answer
40
views
WinGraph32 for the OllyFlow plugin
I am trying to use the OllyFlow plugin for OllyDbg 1.10. It requires WinGraph32.exe, which was apparently distributed with IDA at some point, because the book Game Hacking says:
Wingraph32 is not ...
- 103
2
votes
1
answer
66
views
Am I missing symbols when RE'ing shellcode?
I have a question about reversing a tutorial which shows how to reverse engineering shellcode. My question is simple:
In figure 4, we see at (7) TEX.ProcessEnvironmentBlock: is this a comment, or was ...
1
vote
1
answer
44
views
Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro
We have an EXE that IDA pro lists the following segments:
Name Start End R W X D L Align Base Type Class AD es ss ds fs gs
cseg01 00000000 0000EA50 ? ? ? . ...
- 1,155
1
vote
0
answers
379
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6 wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files not ...
- 111
1
vote
1
answer
34
views
Under what circumstances relative to instr rip+offsets to .rdata data may not match?
I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
- 43
1
vote
1
answer
38
views
Cannot reset botched IDA setting
I managed to accidentally modify the opcode column setting of the view window to display the data in word format (2 byte). For the life of me I cannot seem to figure how to switch if back to byte ...
- 11
3
votes
1
answer
92
views
How to select an item in IDAPython, in decompilation view?
I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures).
I have changed the arguments types for a list of ...
- 168
1
vote
1
answer
118
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 113
1
vote
0
answers
49
views
Auto-loaded type information and relationship between .til and .sig: how to find links and how to change them (config)?
NB: most of my targets are PE files for pc, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm.
Let's say I load a PE ...
- 10.6k
2
votes
0
answers
120
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
3
votes
1
answer
75
views
View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra
I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere
And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
- 131
0
votes
1
answer
67
views
IDA not allowing Memory Mapping
I own an electronic instrument that has video display which has a horizontal timing issue. The graphics display initialization is done in a 256K bootrom and the desire is to use IDA to reverse the ...
- 11
2
votes
0
answers
202
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 189
0
votes
1
answer
52
views
Why does tif.get_func_details sometimes only starts to work after decompiling the function?
I am going through a huge executable and am fetching information about functions arguments this way:
tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t()
assert ida_nalt.get_tinfo(...
- 168
0
votes
1
answer
92
views
IDAPython Get Function Parameter Type Name
I'm currently trying to make a hotkey to rename example functions sub_123450(aType* this, void* a2) to aType::123450(aType* this, void* a2). I have code to rename etc. but how can I get the name of ...
- 75
0
votes
1
answer
149
views
Using IDA pro decompiler in Ghidra
Is it possible to use IDA pro decompiler in Ghidra ?
I know the opposite is possible.
- 21
-1
votes
1
answer
50
views
My IDA have 2 different address for same code How to change it
I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
- 1
1
vote
1
answer
64
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
