All Questions
Tagged with ida binary-analysis
78 questions
-3
votes
1
answer
2k
views
Identification of AES portion code in binary
I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
1
vote
2
answers
163
views
How is the IV generated from a timestamp based on this function?
Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
- 13
0
votes
1
answer
563
views
IDA Pro Address doesn't correlate to Immunity Debugger address
I'm trying to use immunity debugger to step through a confusing binary.
When I open it in IDA Pro, I see certain addresses next to the instructions:
.text:01001392 inc eax
When I ...
- 1
0
votes
1
answer
499
views
reverse engeeneering the 3d file of a game [closed]
I have a problem to find out how to open a file of a game this one seems to have encrypted its files.
Currently all I know about the file is that it seems to be a custom 3D file.
here is the file ...
5
votes
2
answers
355
views
Flare-ON#3: Problem understanding some parts in the program
I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
5
votes
3
answers
2k
views
Changing a windows name by patching create window function call
I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
- 51
1
vote
2
answers
4k
views
binwalk on reversing switch firmware
everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help.
first i extract the .bin file from the switch and use binwalk ...
- 11
4
votes
2
answers
5k
views
How to get the disassembly line without offset translations in IDAPython?
When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.
For example, when raw assembly is:
mov %r15, 0x20b062(%rip)`
GetDisasm()'s ...
- 115
2
votes
1
answer
929
views
How to adjust function type/call parameters to custom structs in IDA Pro?
I'm trying to reverse-engineer a function in IDA Pro that was originally identified by IDA as such (I was able to rename it into Device_CreateCloseIoControl):
but I know that this function was ...
- 1,761
8
votes
1
answer
5k
views
Zte Reverse engineering config.bin file problem
I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider.
My first discovery was that the eth Lan ports are bricked wich
means I can only use ...
2
votes
0
answers
1k
views
IDA Pro user-defined offsets (again)
I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset.
I have a line of code as:
ld de, #0x6058
and FTR, this address ...
4
votes
3
answers
2k
views
Automatically decode PUSH+RET call into JMP
While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here.
So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
- 823
1
vote
1
answer
637
views
Specific byte purpose in header of little endian ARM binary
I have a little endian 32-bit ARM binary, compiled for a CPU that's running embedded Linux. I want to figure out what a specific byte in the binary means. An example hex view of the first few bytes of ...
- 113
1
vote
1
answer
121
views
Distinguish between local function calls and external(imported) function calls in a dynamic trace
I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions!
Now I have ...
- 171
1
vote
1
answer
570
views
Working with unsupported binary formats
Sometimes I can't start debugging binary due to being unsupported format for example in IDA. For example I found a Nintendo 3DS game and want to debug it. But the problem is that I can't start ...
- 11
1
vote
1
answer
263
views
Is there anyway I can iterate all the C-level statements in IDA-Pro?
I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program.
Suppose I only consider these statements:
State :: =
| if-else cond;
|...
- 2,485
1
vote
2
answers
1k
views
Understanding packet byte structures with OllyDbg
I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received.
Packets like login are easy to structure because ...
- 235
4
votes
4
answers
2k
views
Tools to show the registers and memory locations in use during execution?
I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
user4466
1
vote
2
answers
665
views
What is the address of main() and how many bytes does it allocate on the stack for its frame size?
Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
user4466
1
vote
1
answer
856
views
Cannot find the caller of the main function in a disassembled firmware
I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this:
init()
...
- 141
5
votes
1
answer
6k
views
Find the C++ STL functions in a binary
I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).
I know some parts of the operating system ...
- 53
4
votes
1
answer
3k
views
Difference Between Binary Exploitation and Reverse Engineering?
I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
- 143
10
votes
1
answer
1k
views
Static analysis data combined with dynamic analysis knowledge
What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
- 2,038
17
votes
3
answers
8k
views
Parsing/Rescuing corrupted IDA database
I'm reversing an application with IDA.
My VM crashed and left the IDA database in a corrupted unpacked state.
The next time I tried to load it back, IDA gave me the following error message: The ...
- 2,038
3
votes
1
answer
2k
views
IDA Pro only recognizes my files as BINARY
I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
- 495
5
votes
1
answer
303
views
Reverse engineering in pairs - is it possible?
I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers.
Are there any suitable methodologies, tools to help in such work?
UPDATE
This is ...
- 3,072
6
votes
1
answer
3k
views
IDA Pro for MIPS image
I have this file:
[ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin
cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data
It's image for Cisco Catalyst 3650 ...
- 161
5
votes
1
answer
4k
views
How to reverse command line arguments?
I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
- 3,088