All Questions
Tagged with ida binary-analysis
78 questions
17
votes
3
answers
8k
views
Parsing/Rescuing corrupted IDA database
I'm reversing an application with IDA.
My VM crashed and left the IDA database in a corrupted unpacked state.
The next time I tried to load it back, IDA gave me the following error message: The ...
- 2,038
12
votes
4
answers
6k
views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
- 323
10
votes
1
answer
1k
views
Static analysis data combined with dynamic analysis knowledge
What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
- 2,038
8
votes
1
answer
5k
views
Zte Reverse engineering config.bin file problem
I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider.
My first discovery was that the eth Lan ports are bricked wich
means I can only use ...
7
votes
2
answers
2k
views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
- 143
6
votes
1
answer
3k
views
IDA Pro for MIPS image
I have this file:
[ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin
cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data
It's image for Cisco Catalyst 3650 ...
- 161
5
votes
2
answers
355
views
Flare-ON#3: Problem understanding some parts in the program
I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
5
votes
1
answer
6k
views
Find the C++ STL functions in a binary
I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)).
I know some parts of the operating system ...
- 53
5
votes
1
answer
4k
views
How to reverse command line arguments?
I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
- 3,088
5
votes
3
answers
2k
views
Changing a windows name by patching create window function call
I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
- 51
5
votes
1
answer
303
views
Reverse engineering in pairs - is it possible?
I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers.
Are there any suitable methodologies, tools to help in such work?
UPDATE
This is ...
- 3,072
4
votes
4
answers
2k
views
Tools to show the registers and memory locations in use during execution?
I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
user4466
4
votes
3
answers
2k
views
Automatically decode PUSH+RET call into JMP
While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here.
So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
- 823
4
votes
2
answers
5k
views
How to get the disassembly line without offset translations in IDAPython?
When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.
For example, when raw assembly is:
mov %r15, 0x20b062(%rip)`
GetDisasm()'s ...
- 115
4
votes
1
answer
3k
views
Difference Between Binary Exploitation and Reverse Engineering?
I am a beginner in Reverse Engineering and am trying to improve my skill by participating in any CTF's I can and solving CrackMe's. I am trying to find out why Binary Exploitation and Reverse ...
- 143
4
votes
1
answer
211
views
Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?
The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption.
Does any one recognize this pattern?
Is it maybe some kind of ...
- 289
3
votes
1
answer
2k
views
IDA Pro only recognizes my files as BINARY
I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
- 495
3
votes
1
answer
889
views
Remove Binary from IDA Database
I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
- 131
3
votes
0
answers
1k
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
2
votes
1
answer
510
views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
- 323
2
votes
2
answers
273
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
2
votes
1
answer
216
views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
- 83
2
votes
2
answers
909
views
GetProcAddress with 0 as lpProcName
I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.
The binary is a 10 level reversing game where you get ...
- 133
2
votes
1
answer
809
views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
- 221
2
votes
1
answer
929
views
How to adjust function type/call parameters to custom structs in IDA Pro?
I'm trying to reverse-engineer a function in IDA Pro that was originally identified by IDA as such (I was able to rename it into Device_CreateCloseIoControl):
but I know that this function was ...
- 1,761
2
votes
1
answer
604
views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
- 23
2
votes
1
answer
3k
views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
- 121
2
votes
1
answer
619
views
How can I determine a module to which function is related with IDA Pro
For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained ...
- 23
2
votes
0
answers
88
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
1k
views
IDA Pro user-defined offsets (again)
I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset.
I have a line of code as:
ld de, #0x6058
and FTR, this address ...
1
vote
2
answers
665
views
What is the address of main() and how many bytes does it allocate on the stack for its frame size?
Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
user4466
1
vote
2
answers
1k
views
Understanding packet byte structures with OllyDbg
I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received.
Packets like login are easy to structure because ...
- 235
1
vote
4
answers
691
views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
- 11
1
vote
2
answers
2k
views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1
answer
1k
views
Ida - what is Parse C header file
In ida File->Load file there is option Parse C header file, I want to understand that .
If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
- 41
1
vote
1
answer
4k
views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
- 11
1
vote
2
answers
163
views
How is the IV generated from a timestamp based on this function?
Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
- 13
1
vote
1
answer
856
views
Cannot find the caller of the main function in a disassembled firmware
I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this:
init()
...
- 141
1
vote
1
answer
120
views
Under what circumstances relative to instr rip+offsets to .rdata data may not match?
I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
- 53
1
vote
1
answer
1k
views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
- 13
1
vote
3
answers
809
views
What is the difference between malware that is 'dumped' and one that is 'unpacked'?
On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
- 233
1
vote
2
answers
4k
views
binwalk on reversing switch firmware
everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help.
first i extract the .bin file from the switch and use binwalk ...
- 11
1
vote
1
answer
642
views
Ida cannot open. a files of esp32 (Xtensa)
I tried to open this file with IDA Pro
https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a
Ida detect that is ELF for Xtensa (relocatable)
But when I tired to open it I got
Undefined ...
- 281
1
vote
1
answer
1k
views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
2
answers
248
views
Gui disabled program functionality
Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.
Right now there's one button remaining labeled "Encrypt", which is greyed ...
- 173
1
vote
2
answers
4k
views
running IDA python without gui
I am trying to run IDA without GUI. My purpose is to run a specific script that receives arguments via my main program against multiple files, but for some reason, it does not work for me. Sometimes ...
- 71
1
vote
1
answer
2k
views
How to find out address in binary file (like IDA) with python code only?
I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
- 41
1
vote
1
answer
544
views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
- 203
1
vote
1
answer
637
views
Specific byte purpose in header of little endian ARM binary
I have a little endian 32-bit ARM binary, compiled for a CPU that's running embedded Linux. I want to figure out what a specific byte in the binary means. An example hex view of the first few bytes of ...
- 113
1
vote
1
answer
121
views
Distinguish between local function calls and external(imported) function calls in a dynamic trace
I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions!
Now I have ...
- 171