All Questions
81 questions
32
votes
5
answers
12k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,485
11
votes
3
answers
113k
views
How to obtain x86-64 pseudocode in IDA Pro?
Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
- 119
10
votes
2
answers
6k
views
Why does IDA add "db" statements between disassembled code
I'm trying to analyze a MS-DOS COM file that I wrote a few years ago with IDA Free 5.0, I've since renamed the segment to code_and_data and named constants and set data types correctly. However, when ...
- 203
10
votes
2
answers
9k
views
Mixed 16/32-bit code reversing using IDA
I am trying to reverse engineer a binary blob I expect to transition from 16-bit real mode into 32-bit protected mode (it is boot time code), so I expect the code to contain code of both sorts.
When ...
user1797
7
votes
1
answer
1k
views
understanding the stack
I have de-assembled a x86 application use ida, it generates
the following code
.text:1084FF10 push ebp
.text:1084FF11 mov ebp, esp
.text:1084FF13 ...
- 226
7
votes
1
answer
1k
views
How to get IDA Pro Free to automatically change segment on retf?
I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be.
There's a simple set of ...
- 203
6
votes
2
answers
7k
views
Question about LEA instruction
i'm learning to reverse engineer. So i'm coding some programs and try to understand their assembly.
I stumbled upon a curious case and i think i can't solve it alone.
Here's the c code:
#include &...
- 193
6
votes
1
answer
3k
views
How can I extract the structure of an operand with displacement in IDAPython?
Consider the following instruction:
8D 8C 4E B0 2F FF FF LEA ECX, [ESI+ECX*2-0xD050]
Using IDAPython, how can I extract the structure of the second operand? I'd like to know things like:
ESI is ...
- 185
6
votes
1
answer
8k
views
What does arg_0 = dword ptr 4 mean?
I try to use IDA dissembler and I don't really understand the following text paragraphs appearing at the head of functions:
arg_0 = dword ptr 4
Can anyone explain their meaning?
- 333
5
votes
2
answers
355
views
Flare-ON#3: Problem understanding some parts in the program
I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
5
votes
2
answers
499
views
BIOS first jump leads to empty memory
I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
- 63
5
votes
1
answer
2k
views
What's the meaning of dword_XXXX and offset dword_XXXX in IDA?
Consider the following code:
In C++:
SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized
void someFunction()
{
globalPointer->...
- 175
5
votes
3
answers
2k
views
Changing a windows name by patching create window function call
I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
- 51
5
votes
1
answer
2k
views
How to specify stack-based return values in IDA Pro (GoLang)
tl;dr: I am reversing a GoLang 1.10 executable, compiled for Windows. I am trying to make IDA correctly recognize the calling convention.
Details: I am looking at an x86 executable where the ...
- 61
4
votes
3
answers
3k
views
IDA: add segments without losing data
I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure.
...
- 55
4
votes
1
answer
384
views
Take A Snippet of Assembly and Make All Side Effects Explicit?
I came across a small function whose only side effects were to modify the state of some processor flags. When I decompiled this function using the Hex Rays decompiler, I simply got an empty function, ...
- 1,537
4
votes
1
answer
277
views
How to force IDA to show size of pointer dereference?
IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:
mov ecx, ...
4
votes
2
answers
2k
views
How do you look for a a particular value at address in IDA
So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch]
...
lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
- 41
4
votes
1
answer
253
views
What is the pictured x86 technique/area called?
I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
- 1,880
4
votes
0
answers
1k
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 195
3
votes
1
answer
4k
views
How to create function prototype that recognizes arguments passed by reference in IDA Pro
I have a function prototype generated by IDA that looks like this:
However, it looks like there is a struct being referenced at the instruction lea edi, [esp+290h+var_240]. I would like IDA to ...
- 430
3
votes
1
answer
1k
views
IDA PRO and Dos Load Exec
I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace?
It has already ...
- 31
3
votes
2
answers
3k
views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
- 41
3
votes
1
answer
4k
views
Can I use python3 with IDA 7.0?
Got IDA Pro 7.0 (I can't update at the moment),
I'm currently unable to use idapython.
I have python3.8 installed on my machine and nothing else (I dont want any collisions).
How can I use make ...
3
votes
1
answer
983
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
- 31
3
votes
0
answers
1k
views
loading memory dump into ida pro?
I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
- 101
3
votes
1
answer
190
views
Instruction without "apparent" previous instruction
I am working through the educational "bomb.exe" file where you must defuse the bomb by entering the correct inputs. This can only be accomplished by reversing the executable file. There are no hints ...
- 175
2
votes
5
answers
30k
views
Older versions of IDA free?
I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither.
Does ...
- 61
2
votes
2
answers
3k
views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
- 21
2
votes
1
answer
291
views
Why is IDA showing three arguments for the main function instead of two in some linux binaries?
So I am reversing an ELF binary, now from my knowledge in C the main function has two argument, argc and argv
but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
- 232
2
votes
1
answer
185
views
How to identify when a function is being called using IDA?
I'm debugging a .exe file on Windows with IDA's debugger.
How can I identify when the code calls the random() function?
- 21
2
votes
1
answer
578
views
x86 - How do I detect virtualized code by looking at the assembly?
How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
- 69
2
votes
1
answer
387
views
What does __return_ptr do in IDA?
Let's say I have this program:
struct A {
int x;
};
struct A func1(int z) {
struct A result;
result.x = z+1;
return result;
}
int main() {
return func1(1).x;
}
When compiling ...
- 123
2
votes
2
answers
123
views
X86 access to global strings pattern
While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it.
.text:00002560 ...
- 1,858
2
votes
1
answer
889
views
Can Ghidra do backward symbolic execution?
I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
2
votes
1
answer
3k
views
Finding address in IDA from address found in Cheat Engine
I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
- 21
2
votes
0
answers
88
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
0
answers
326
views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
2
votes
0
answers
134
views
Trace replayer won't load binary debug information
So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
- 475
1
vote
2
answers
185
views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
- 323
1
vote
2
answers
369
views
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
- 69
1
vote
2
answers
592
views
Dealing With x86 Segmentation Overlaps
I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly.
I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
- 173
1
vote
2
answers
2k
views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
2
answers
163
views
How is the IV generated from a timestamp based on this function?
Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
- 13
1
vote
2
answers
111
views
IDAPython: Getting all arguments passed to function
I am working on getting two specific arguments from a function that is called around 1000 times in an executable. Is there any way of looping through all XREFs that reference the function and print ...
- 13
1
vote
1
answer
351
views
List instructions to fix wrong IDA analysis
I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
- 197
1
vote
1
answer
114
views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
- 13
1
vote
1
answer
699
views
What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?
I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
- 13
1
vote
1
answer
211
views
Displaying Operands as Position Independent in IDA
I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format'
lea rdi, format
However, when ...
- 13
1
vote
1
answer
255
views
ELF file crashing after executing shellcode
So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it:
// write string and jump to OEP, ...
- 437