All Questions
81 questions
1
vote
1
answer
479
views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
- 1,267
1
vote
1
answer
424
views
Weird IDA/Decompiler floating point output
I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before.
// a2 is always 60.0
void some_function(struct_123 *this, float a1, float a2)
{
...
1
vote
1
answer
544
views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
- 203
1
vote
1
answer
644
views
IDA Interpreting mov instructions in a unusual way
When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset.
Hex rerpresentation: 8B 40 0A
Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
- 11
1
vote
1
answer
432
views
While loop function disassembly x86
I am trying to convert this binary to C but I am having trouble with the while loop. What does
sub esp, 8 mean? as well as push [ebp+_a] ? I am able to get the esp 8 sometimes while changing the ...
- 21
1
vote
1
answer
138
views
Data moved after program rebase
Consider the following piece of code:
.text:00F74B42 call sub_12D1130
.text:00F74B47 mov eax, dword_15A0C80
Now, I want to add a sanity check but as I don't have enough space to do that I ...
- 21
1
vote
1
answer
2k
views
How to move one step back in a debugger
When I debug a .exe file on Windows with IDA, I do it step by step.
Can I move one step back and reset all the registers and stack to what they were one instruction ago?
By the way, when I'm looking ...
- 533
1
vote
1
answer
1k
views
Hex-Rays can't parse switch (bad target for case)
I need to add new case, so here is that I do.
Copy the jump table for switch statement to 0048199C and add new ref to 4819C0.
Add new instructions below
Set new address 0048199C
In the indirect ...
- 21
1
vote
1
answer
870
views
IDA Pro - configure register clobbering
TL;DR:
The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...
- 23
1
vote
0
answers
315
views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
1
vote
0
answers
339
views
Is there a way to generate a PE from a web assembly module?
I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
- 11
1
vote
0
answers
936
views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
- 215
0
votes
4
answers
6k
views
Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?
I am thinking of buying IDA Pro for my Linux programming environment after reverse engineering a bit with OllyDBG (under WINE)... But before I endorse into such a costly purchase I ask the following ...
user5827
0
votes
1
answer
172
views
Why Ida pseudo-code translate test as AND?
In IDA when disassembling a x86 EXE file there is a line
test byte ptr [ebp+XXX], cl
Before this line cl has a value of 0x11
The Hex-Rays decompiler plugin translates it as if (v10 &0x11).
Why ...
- 27
0
votes
2
answers
4k
views
What does this code do, and what does it look like in C?
I'm using IDA to disassemble a file, and one of the sections contained this. What is this doing? What would it look like in C?
I believe it pushes edx onto the stack, and converts it to an integer ...
- 113
0
votes
1
answer
121
views
Keygenme - Key location
So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction:
...
- 437
0
votes
1
answer
1k
views
Stack pointer values in IDA Pro
I wonder why the values of the stack pointer in IDA Pro have similar values.
Can anyone explain their meaning?
- 333
0
votes
1
answer
236
views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
- 67
0
votes
2
answers
695
views
IDA Pro, replace exit() with continue;
This is the function:
loc_BA060: ; status
xor edi, edi
call _exit
How can one replace exit with continue?
- 23
0
votes
1
answer
452
views
Linked list in IDA
I debug a program with IDA, it have a part of code that i don't understand
loc_8048E30: ; CODE XREF: phase_6+9Ej
.text:08048E30 mov esi, [esi+8]
.text:08048E33 inc ...
- 333
0
votes
1
answer
445
views
Create unprotected executable for program that decrypts itself at run-time dynamically? [closed]
Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me.
I'd like ...
- 163
0
votes
3
answers
1k
views
Order of arguments in __usercall
I have the following function with five arguments:
; int __cdecl trampolineRegister(void)
a4= dword ptr 8
a5= dword ptr 0Ch
push ebp
mov ebp, esp
add eax, ...
- 1
0
votes
1
answer
563
views
IDA Pro Address doesn't correlate to Immunity Debugger address
I'm trying to use immunity debugger to step through a confusing binary.
When I open it in IDA Pro, I see certain addresses next to the instructions:
.text:01001392 inc eax
When I ...
- 1
0
votes
1
answer
402
views
Why ida use redundant registers?
I wrote a statement in visual studio.
int sum(int a, int b){
return a + b;
}
int main(){
tong(3,4);
return 0;
}
And aften i use ida pro Disassembly it. And my function tong has ...
- 333
0
votes
1
answer
177
views
Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program
I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below:
The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to ...
- 828
0
votes
1
answer
155
views
When might a compiler generate JG/JS/JP conditional jumps?
I was wondering where i might encounter JO/JS/JP JCCs (and their not-counterparts) in compiler generated code? What would it mean? I scrolled through a lot of random code, but wasnt able to find a ...
- 463
0
votes
1
answer
1k
views
IDA stack pointer analysis fails due to "and" operation to esp
I'm reversing an x86 executable with IDA pro. Here is the beginning of the function causing problems to IDA stack pointer analysis. I'm showing the stack pointer value in the second column:
.text:...
- 183
0
votes
0
answers
65
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,103
0
votes
2
answers
85
views
Composition of a Binary File trouble [closed]
I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-...
0
votes
1
answer
411
views
Some help with disassembled code understanding
I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how ...
- 103
-1
votes
1
answer
315
views
where the variable and it's size are stored inside windows executabe file?
i am beginner in reverse engineering. i want to understand where the variables and it's size are stored inside an windows executable file.
somehow i can able to find the values of variables i ...
