Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,880
questions
0
votes
1answer
14 views
Does opening a crash dump run a file in memory?
I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
1
vote
0answers
14 views
Easiest way to move everything, including custom structs, from an IDA Pro IDB to another?
I have analyzed a 32 bit version of an executable, defined many structs, renamed many things and so on.
Now i want to move everything, including the structs that i defined, to the IDB of the 64 bit ...
0
votes
0answers
23 views
Red color in IDA
Why in IDA the numeric offset next to [ebp- marked with black letters in red background?
.text:004015D0 ; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)...
0
votes
0answers
10 views
How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)
In IDA Pro, when you create a custom struct, and apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable it only prints ...
1
vote
2answers
37 views
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
0
votes
0answers
27 views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
-2
votes
0answers
22 views
How can i read offset from branch opcode of thumb mode
I have a function that can make a branch opcode:
uint32_t JMPCode(uintptr_t func, uintptr_t addr)
{
uint32_t code = ((addr-func-4) >> 12) & 0x7FF | 0xF000 | ((((addr-func-4) >> 1) &...
2
votes
1answer
54 views
Disable optimization of for loops in Hex Rays Decompiler
Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
2
votes
2answers
42 views
How to import macro as enum into IDA Pro?
Is there any tools can auto generate enum type by macro?
For example, NTSTATUS in Windows defined as
#define STATUS_ILLEGAL_INSTRUCTION ((NTSTATUS)0xC000001DL)
#define ...
1
vote
1answer
38 views
Double jump when calling functions
I wanted to ask why there is a double jump when calling some functions? For example first call:
.text:005AC266 push eax
.text:005AC267 call j_WinRegisterWindow
...
0
votes
1answer
38 views
How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?
; PCWSTR __stdcall RtlGetNtSystemRoot()
public RtlGetNtSystemRoot
RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p
...
0
votes
0answers
20 views
How to change the color of a graph edge and custom hints in IDA
I would like to access the API to change the color of graph edges to reflect my assessment of their correctness (I already know how to do this within the tool, I need to do it programmatically). There'...
1
vote
1answer
55 views
List instructions to fix wrong IDA analysis
I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
1
vote
2answers
62 views
How do I find where in the code a particular Windows Resource is used?
I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
2
votes
1answer
73 views
How do I reverse engineer structs that are put as parameters in a function
how do I go around figuring out where to reverse engineer a struct?
As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
1
vote
1answer
66 views
Exporting all function addresses from IDA
I have a x86 executable opened in IDA.
In the function window you can see a list of all functions with their starting address.
My goal is to programmatically export a list of all functions IDA found ...
2
votes
2answers
79 views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
-1
votes
2answers
47 views
Parse offset to PE struct
Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example:
I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
1
vote
1answer
72 views
How could I find a call of a function thats only referenced inside a vftable?
So I have this function which I'm trying to figure out the arguments to.
However, all the xrefs of it point to a VFTable.
How would I find a call for this function?
1
vote
1answer
75 views
How to get function signature using IDA Python in IDA Pro
I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names.
I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
0
votes
1answer
77 views
How do I find a function and find out what it does using reverse engineering?
I am attempting to find a function in a specific game. Is there anyway that , using the assembly code I get from decompiling the game in either Ida or x64dbg , I can locate a function I am ...
2
votes
1answer
110 views
Finding function from pattern
I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find:
\x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C
\x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
0
votes
0answers
26 views
Injecting class into the JNIEnv in android jni
void *handle = dlopen("/data/local/tmp/libnative-lib.so", RTLD_LAZY);
if (!handle) {
printf("\nFailed to load library\n");
}
void *offset = dlsym(handle, "...
1
vote
0answers
37 views
How to hide NOPs in IDA?
I am trying to understand a method in IDA Free and I find the NOPs, especially the multibyte NOPs confusing.
Is it possible to hide these? I believe that they are not relevant for my understanding.
2
votes
1answer
91 views
In IDA what does db and dd offset means in data section?
So, in .data section there is some variable, and after it there is db or dd (offset). What exactly does this mean? And what does “align” means? Is there any Wiki or something like that that tells all ...
2
votes
0answers
59 views
Strange exception thrown while debugging in Win10, but not Win7
I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
1
vote
0answers
56 views
IDA tracing not working
I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called.
I have tried to use IDA Tracing, but it doesn't print to file.
1
vote
1answer
39 views
How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]
I have this class with constructor offsets and attributes:
public class example
{
// Fields
public float Attribute_1 = 1.5f; // 0x8
public int Attribute_2 = 102 ; // 0xC
// RVA: ...
1
vote
1answer
53 views
Can I get loaded pdb file path from IDAPython?
IDA Pro can automatically download and load .pdb files from symbol server.
And now I want to write an IDAPython plugin to obtain some data from the .pdb file.
But I don't know how to get the file path ...
1
vote
1answer
97 views
A tutorial or docs to unpack a custom packed PE
I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
2
votes
1answer
75 views
Free alternative to Lighthouse Code Coverage Explorer?
I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
2
votes
1answer
114 views
Does Ghidra have an equivalent to IDA's "Evaluate Expression" feature?
This is the window that appears when you press Shift + /.
Example:
1
vote
0answers
40 views
identify the functions of stripped binaries
As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are ...
0
votes
1answer
54 views
idapython: type information with different prefixes
I checked how to get type information here - https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf.html
Although, I am not sure what these different type prefixes mean. For e.g. BT_{...
1
vote
0answers
41 views
Force IDA to redo SP analysis?
I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original ...
0
votes
1answer
56 views
IDAPython: function parameters and return value
I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using
tif = idaapi.tinfo_t()
ida_nalt.get_tinfo(tif, ea)
function_type = tif....
1
vote
1answer
64 views
Re-analyse HexRays decompiled output
I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures.
How do I automatically ...
1
vote
1answer
67 views
How is it possible to generate C++ class header from a .dll or ELF file?
I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
0
votes
1answer
99 views
IDA interpretation of switch-case statement
This is my first question on this forum, so I hope that it would not be offensive or redundant.
So recently I am attempting to developing some kernel extensions for Apple's macOS using the IOKit ...
1
vote
1answer
59 views
IDA Pro - configure register clobbering
TL;DR:
The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...
0
votes
1answer
33 views
Prevent IDA from jumping to disassembly when debugging with decompiler
I've noticed that whenever I'm single stepping for loops inside IDA hexrays decompiler it'll jump to the disassenbly view, doesn't matter if I step through with F8 ou F7, what gives and can I prevent ...
0
votes
1answer
40 views
Change global variable value in IDA
I have a global variable stored in the data section:
data:00007FF7DDBF78E4 00 00 00 00 dword_7FF7DDBF78E4 dd 0
Is there a way to change its value?
2
votes
0answers
43 views
calculate memory address from IDA to use with Frida
I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.
I debug an Android application with Frida, how can I put this address in Frida to watch this value?
I ...
0
votes
1answer
50 views
How to make a screenshot of a graph view in IDA on Windows?
Trying to save a big graph(the default graph view of assembly instructions in IDA after you press space in text view while viewing instructions of a function) as an image.
Googled this article: ...
1
vote
1answer
82 views
Analyze Arm Linux CPP binary in Ida Pro
I tried to open CPP binary with Ida. Most of the code analyze well .
The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
1
vote
1answer
72 views
IDA Pro: unknown warnings
I am using IDA pro to analyze an old nginx binary. I am getting following warnings which I have never seen before. Does anyone have an idea about these warnings?
IDA is analysing the input file...
You ...
0
votes
0answers
35 views
How to record all the "call instructions" for a brief interval?
I want to find the GUI push buttons callback function address (Qt app). I am thinking of recording all the call instructions during the short duration it takes to click the button and inspect all of ...
2
votes
1answer
92 views
Useless instructions in a compiled getter
This is the second time I see this kind of function today :
.text:00000000000010B0 sub_10B0 proc near ; CODE XREF: sub_1120:loc_1143↓p
.text:00000000000010B0 lea ...
2
votes
1answer
78 views
Split variable in Ida Pesudo Code
Sometime the meaning of variable has been changed on the function.
For example from Ida pseudo code:
a = price
....
a= tax....
In the beginning of function a was price and after that a is tax.
How ...
3
votes
1answer
49 views
Find all x-ref with specific argument with IdaPython
I have a function at 0xabcd that is called a few times like Func(1,2,3) and Func(4,4,5).
I want to find all the references where the third argument is 5.
import idautils
for f in list(idautils.XrefsTo(...