All Questions
17 questions
1
vote
0
answers
112
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 33
3
votes
1
answer
474
views
Automatically name class methods in IDA
Let's say I have:
mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function
Is there a feature/plugin/script to automatically rename all subroutine occurrences to:
mov ecx, [...
1
vote
1
answer
313
views
Static Code Analysis of a C166 function
I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
- 61
1
vote
0
answers
369
views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
- 11
0
votes
1
answer
159
views
How to simplify a function "calling itself's reference"
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
- 123
1
vote
4
answers
691
views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
- 11
2
votes
0
answers
202
views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
- 147
-2
votes
1
answer
550
views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
- 147
1
vote
2
answers
165
views
Automated Branch Input Generation
Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line ...
- 233
2
votes
1
answer
2k
views
How to search sequence of API call using IDA Pro?
I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
- 141
0
votes
1
answer
5k
views
Red addresses in IDA Pro
I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called.
But I have found a piece of code that is marked red, but when debugging, I saw ...
- 187
3
votes
2
answers
4k
views
IDA Pro: Side effects or disadvantages of "Create function"
Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot.
Yet, one can right-click such 'function-...
- 1,560
4
votes
1
answer
2k
views
What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?
I know that
Dynamic program analysis is the analysis of computer software that
is performed by executing programs on a real or virtual processor.
while
Static program analysis is the ...
3
votes
1
answer
2k
views
How to find memory addresses which are read from but not written to
Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses...
Is there any such functionality in IDA ...
- 203
7
votes
3
answers
9k
views
IDA Pro function stack frame view
IDA Pro displays certain buffer or padding above (at lower addresses) local variables in stack frame view. For instance:
Example 1.
The following screen shot of stack frame view shows 12 bytes (...
- 3,088
16
votes
1
answer
6k
views
IDA EBP variable offset
Let's take a look of how IDA displays address of local variable. For instance:
MOV EAX, [EBP + var_4]
As we all know as far as local variables go, they are located at lower addresses of EBP.
Though,...
- 3,088
27
votes
6
answers
3k
views
Tools to work cooperatively on the same binary
What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work?
I used various methods long ago to share information with others, but not ...
- 6,704