Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,430
questions
0
votes
1answer
10 views
indirect return value address
I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void.
I've noticed that every calle reads from x8/w8 afterwards, from wikipedia;
...
0
votes
1answer
13 views
IDA Change ram and rom without reopen IDA
when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary.
Is there any smart way ?
0
votes
1answer
33 views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
0
votes
0answers
12 views
How to load a library at a specific address in IDA and re-analyze the program statically?
I have a dumped PE that has calls like
call ds:dword_4010B4
now these are actually addresses of APIs in kernel32.dll
my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
2answers
50 views
How to solve this anti-disassembler trick?
I have this __asm instruction in C code:
int func_0x8b4c55a0()
{
__asm
{
call $ +5
add[esp],5
ret
}
}
int main()
{
char cVar1;
if ((cVar1 = ...
0
votes
0answers
15 views
How to dump a unpacked PE and still get the API names with IDA when they are called directly?
So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header)
i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
-1
votes
1answer
48 views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
2
votes
2answers
118 views
CPU support by ghidra
Where can I see all the CPUs supported by Ghidra?
Does Ghidra support more CPUs than IDA Pro?
1
vote
1answer
26 views
Is there a way to edit structure field value in memory during debug
I'm debugging some code and I know that there's a structure in memory, I have a definition of the structure, I apply it on memory, then I look at the structure field values, and I see that one of the ...
0
votes
0answers
78 views
How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange
This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine ...
0
votes
1answer
43 views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
0
votes
0answers
29 views
IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions
I am currently dealing with obfuscated code in IDA.
The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
1
vote
0answers
37 views
TMS320VC5416 DSP firmware reversing
I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers:
page: 0000 offset: 0080 len: 0149
page: 0000 ...
0
votes
0answers
18 views
How to make library functions linked statically to extrn?
I want to write an IDAPython script which will identify all statically linked libraries (I think I got that part down - starting from a certain address they all seem to be library functions) - then ...
-1
votes
1answer
52 views
Break when exe send tcp packet
When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet.
When I listen with procmon I can see that this exe send and recive tcp packet.
1) I look on the exe file ...
0
votes
1answer
35 views
IDA - How can I get a list of differing instructions from 2 recorded instruction traces?
I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions?
I am able to load the diffs as overlays but there are a large amount of instructions recorded that are ...
0
votes
0answers
31 views
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
1
vote
2answers
86 views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
0
votes
1answer
28 views
What's wrong with my mitm to support rr commands with gdbserver on IDA?
First of here is the gdb remote protocol doc.
The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
1
vote
1answer
69 views
Why is IDA showing three arguments for the main function instead of two in some linux binaries?
So I am reversing an ELF binary, now from my knowledge in C the main function has two argument, argc and argv
but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
0
votes
2answers
43 views
How to remove bytes/opcodes within IDA Pro database
I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having ...
0
votes
0answers
25 views
<error sending command to monitor>
I'm trying to debug a backtrace created with rr so I type:
rr replay -s 50505 -k
it displays out:
gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target
Then ...
0
votes
1answer
49 views
How to use memory address information from IDAFree to set a breakpoint in x32dbg?
I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
0
votes
1answer
82 views
mfc140 dll , what is the usage?
While I open exe file in ida I can see lot of calls to mfc140_6153
or mfc140_8718.
What are those functions ? what they do ?
thanks
0
votes
2answers
67 views
Hex-Rays skips code
have using IDA Pro 6.8 (Hex-Rays 2.2), default settings.
Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
0
votes
0answers
34 views
IDA search results debugging
I used IDA pro to search for some variables, that I know are present in the exe code (it is a function variable). However it doesn't relate to any function, so how can I make use of it and get the ...
0
votes
1answer
37 views
Why doesn't alloca_probe follow x64 calling convention?
I was practising reverse engineering on some Windows x64 applications when I came across this function:
call alloca_probe
This alloca_probe function has some strange implementation:
EAX is used as ...
2
votes
0answers
40 views
How to prepend offset to smart names?
So I'm trying to reassemble an PE to ELF so I can debug it with rr.
However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
1
vote
0answers
67 views
How to handle flags that affect instruction decoding in IDA processor modules?
I am writing a processor module for the Oki6620* architecture. Like ARM's Thumb mode or m7700's M flag, this architecture has a special flag that affects instruction decoding, named DD (Data ...
1
vote
1answer
83 views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
0
votes
0answers
56 views
IDA: How to set a breakpoint in the address pointed by some address?
I am using IDA for debugging. I have some executable memory being dynamically allocated, and a pointer to it is saved in the data section. I currently set a breakpoint somewhere after that step is ...
1
vote
3answers
108 views
What is the difference between malware that is 'dumped' and one that is 'unpacked'?
On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
1
vote
1answer
70 views
How can I determine a module to which function is related with IDA Pro
For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained ...
0
votes
1answer
44 views
What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?
Sorry if this is a stupid question but couldnt find the answer by googling
Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
0
votes
2answers
102 views
IDA Pro, replace exit() with continue;
This is the function:
loc_BA060: ; status
xor edi, edi
call _exit
How can one replace exit with continue?
2
votes
1answer
93 views
Modify function to return a static value
I am learning IDA pro on a test binary and I'd like to return a static value from this function:
; __int64 __fastcall sub_B580(char *name)
sub_B580 proc near
pai= qword ptr -70h
req= addrinfo ptr -...
0
votes
1answer
59 views
Easy way to understand vulnerable functions while Reversing [closed]
I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code.
As I am new to this stuff, I am getting some issues of ...
2
votes
1answer
172 views
Decompiler attack
I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.:
So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
0
votes
0answers
47 views
Packet: Game last byte encrypted?
12:14
WSARecv()
C3-73-3E-BE-36-2F-14-37-37
F4-44-09-89-01-18-23-00-00
------------------------------------------
12:14
send()
C3-73-38-31-0E-35-EE-35-A5-35-7F-34-37-37-8D
F4-44-0F-06-39-02-D9-02-92-02-...
-1
votes
2answers
63 views
How to add a message box to a PE [closed]
So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
0
votes
0answers
79 views
What is, and why, “byte[ ] + number” in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
40 views
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to ...
1
vote
1answer
109 views
Extracting instruction and operand information in IDA Python
I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
81 views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
141 views
How to decrypt the password using radare2 or gdb?
.--------------------------------------------------.
| [0x804851b] |
...
2
votes
0answers
54 views
Telling IDA that all references to an address range belong to the same segment
For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
2
votes
1answer
123 views
Unable to properly analyze a very simple C-compiled program
I'm a RE beginner and I decided to start writing my own simple code for practice.
I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
0
votes
0answers
41 views
How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW
Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW
i tried every combinanated value but without sucess.
0
votes
2answers
40 views
Error when changing push 0 to push function
Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure
I've searched for a fix for a while to no avail
help would ...
0
votes
0answers
15 views
Can the .idb/.i64 default save location be changed?
By default, IDA Pro saves its .idb (or .i64) files to the same directory as the file being analyzed. Is there a way to change this? I couldn't find anything related to this in Options -> General.
