All Questions
Tagged with ida static-analysis
56 questions
27
votes
6
answers
3k
views
Tools to work cooperatively on the same binary
What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work?
I used various methods long ago to share information with others, but not ...
- 6,704
23
votes
1
answer
7k
views
Static analysis of C++ binaries
When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
- 1,234
16
votes
1
answer
6k
views
IDA EBP variable offset
Let's take a look of how IDA displays address of local variable. For instance:
MOV EAX, [EBP + var_4]
As we all know as far as local variables go, they are located at lower addresses of EBP.
Though,...
- 3,088
10
votes
1
answer
1k
views
Static analysis data combined with dynamic analysis knowledge
What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
- 2,038
7
votes
3
answers
9k
views
IDA Pro function stack frame view
IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:
Example 1.
The following screen shot of stack frame view shows 12 bytes (...
- 3,088
5
votes
2
answers
1k
views
Automatic function naming
I'ld like to know how to bulk rename functions in IDA, based on some condition.
Example:
Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
- 2,038
5
votes
1
answer
6k
views
How to create a IDA FLIRT signature for a PPC library?
I'd like to create a IDA FLIRT signature for the following PPC uClibc library:
libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
- 227
4
votes
1
answer
2k
views
What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?
I know that
Dynamic program analysis is the analysis of computer software that
is performed by executing programs on a real or virtual processor.
while
Static program analysis is the ...
3
votes
2
answers
4k
views
IDA Pro: Side effects or disadvantages of "Create function"
Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot.
Yet, one can right-click such 'function-...
- 1,560
3
votes
1
answer
517
views
What is "nullsub_XXX" in vtable in IDA
When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.
But what does nullsub_XXX mean in a vtable structure?
- 183
3
votes
1
answer
178
views
16 bit Dos string concat function
I just got into reversing, i'm a bit puzzled by a part of the following code.
I know what its doing, from a technical aspect, but i don't really understand why its doing it.
This is the part I have a ...
- 133
3
votes
1
answer
2k
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 33
3
votes
1
answer
10k
views
Searching for a sequence of instructions in IDA Pro
How can I search for a sequence of instructions in IDA Pro?
I did manage to search for a single instruction using text search string li.*r4.*-1 (for instruction li r4, -1), but I failed to match ...
- 227
3
votes
1
answer
2k
views
How to find memory addresses which are read from but not written to
Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses...
Is there any such functionality in IDA ...
- 203
3
votes
1
answer
474
views
Automatically name class methods in IDA
Let's say I have:
mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function
Is there a feature/plugin/script to automatically rename all subroutine occurrences to:
mov ecx, [...
3
votes
2
answers
1k
views
How to get elf header via IDAPython?
In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
- 115
2
votes
2
answers
2k
views
Detecting epilogue/prologue of functions [closed]
I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
- 41
2
votes
1
answer
1k
views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
2
votes
1
answer
368
views
Split variable in Ida Pesudo Code
Sometime the meaning of variable has been changed on the function.
For example from Ida pseudo code:
a = price
....
a= tax....
In the beginning of function a was price and after that a is tax.
How ...
2
votes
1
answer
1k
views
Identify function in cpp static binary
When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
- 533
2
votes
1
answer
500
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
2
votes
1
answer
2k
views
How to search sequence of API call using IDA Pro?
I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
- 141
2
votes
0
answers
202
views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
- 147
2
votes
1
answer
620
views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
- 21
1
vote
2
answers
165
views
Automated Branch Input Generation
Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line ...
- 233
1
vote
4
answers
691
views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
- 11
1
vote
2
answers
2k
views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
- 61
1
vote
1
answer
313
views
Static Code Analysis of a C166 function
I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
- 61
1
vote
1
answer
385
views
Memory map in AVR Harvard architecture
In this video https://youtu.be/D0VKuZuuvW8?t=259 .
You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff .
So in the video he ask ...
- 41
1
vote
1
answer
114
views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
- 13
1
vote
1
answer
164
views
Windbg's "dt" equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
1
vote
1
answer
198
views
IDA search results not showing up in a separate window
I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this:
However, when the search ...
- 197
1
vote
1
answer
512
views
finding a checksum function using static analysis (IDA)
I have an dll that is loaded into a 64 bit process, it performs two check sums (at least) one to keep up to date (it receives a 13 character long string from the net which I'm fairly certain is an in ...
- 43
1
vote
1
answer
367
views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
- 147
1
vote
1
answer
622
views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
- 27
1
vote
2
answers
278
views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
- 11
1
vote
1
answer
544
views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
- 203
1
vote
1
answer
291
views
IDA Hex-Rays Generating Redundant Code
Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process.
if ( v1 )
{
v15....
- 113
1
vote
1
answer
263
views
Is there anyway I can iterate all the C-level statements in IDA-Pro?
I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program.
Suppose I only consider these statements:
State :: =
| if-else cond;
|...
- 2,485
1
vote
0
answers
112
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 33
1
vote
0
answers
369
views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
- 11
1
vote
0
answers
698
views
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:
jnb short near ptr loc_1C61B1+3
It order to do this I'm running a snippet like this in a script:
ida_bytes.del_value(...
- 203
1
vote
0
answers
105
views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
- 63
1
vote
0
answers
425
views
Saving IDA Graph to PDF format?
I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that?
I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
0
votes
1
answer
5k
views
Red addresses in IDA Pro
I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called.
But I have found a piece of code that is marked red, but when debugging, I saw ...
- 187
0
votes
1
answer
159
views
How to simplify a function "calling itself's reference"
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
- 123
0
votes
1
answer
842
views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
- 103
0
votes
1
answer
236
views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
- 67
0
votes
1
answer
4k
views
Find functions signatures in Ida?
I didn't understand the subject of find function in Ida via signature.
If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
1
answer
128
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1