Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

Why some functions in IDA can't be searched

I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that. For example, I wanted to ...
0
votes
0answers
9 views

Patching swift methods

The following is taken from a de-compiled iOS app. Is this a swift method? Is it objective-c derived? Why is it showing in IDA as EXPORT? Can this be patched to return 1? EXPORT _$...
4
votes
2answers
2k views

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information : eg: ...
1
vote
2answers
127 views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, std::...
0
votes
0answers
22 views

Edit IDA signal handler

In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application. How can I edit that choose now? I want to ignore this ...
0
votes
0answers
39 views

trying to understand this mov memory[register] instruction

Windows 10, IDA Home, 64bit application compiled with Visual Studio. I'm reverse engineering a crackme and i found this instruction : mov cl, byte_51B000[eax] mov byte_51B018[edx], cl in ...
3
votes
2answers
188 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
1
vote
1answer
773 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
-1
votes
0answers
42 views

Will ida pro have the following features?

First of all, I'm sorry if it's not smooth because it's a translator. I am checking the value of a specific variable using the “watch view” of ida pro. I want to see all the data as a hex string(in ...
0
votes
0answers
30 views

Lexer and parser for .asm file produced by objdump

Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
7
votes
1answer
2k views

Parsing IDA Pro .asm files

Does anyone know of projects that parse the disassembly from IDA Pro using a lexer and/or parser generator library? But I would also totally be fine with JSON or XML format. So far, I have been able ...
1
vote
1answer
68 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
0
votes
1answer
61 views

Find out the name of constants and var in IDA pro

I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I ...
0
votes
1answer
70 views

How to inform Hex-Rays decompiler (7.0) of known register values?

I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
1
vote
1answer
194 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
0
votes
1answer
63 views

what is Off in IDA Pro?

probably silly question, what does Off ... means in IDA Pro? i markered the snapshot as an example.
1
vote
1answer
308 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
0answers
40 views

how to get all “called functions” in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
0
votes
0answers
49 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
0
votes
1answer
30 views

Problem when opening a script file in IDA (syntax error)(pe_sections.idc)

I downloaded the script files from http://www.openrce.org/downloads/details/57/PE_Scripts. Then i extracted the files in the folder idc in the IDA folder (C:\Program Files\IDA 7.0\idc) I opened IDA (...
2
votes
1answer
63 views

WinDBG doesn't resolve function names when debugging kernel module

I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically). Here is a picture ...
1
vote
1answer
87 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
0
votes
1answer
33 views

How to run a process with high privileges using remote debugging

I am using remote debugging with IDA. The target and host machine are Windows. I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
1
vote
1answer
63 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
0
votes
1answer
70 views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
0
votes
0answers
21 views

ida: a better way of printing ida script output on console

I just started exploring ida. I have a simple IDAPython script. import sys import idc import idautils # wait for auto-analysis to complete idc.auto_wait() for ea in idautils.Functions(): print(idc....
0
votes
1answer
49 views

A bit confusion with cheat engine function address and IDA subrutine

I have found a function with Cheat Engine that I like to show in IDA:enter image description here but the function is not present in IDA. Probably I have a bit confusion becouse I don't have ...
1
vote
2answers
49 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
0
votes
2answers
49 views

Order of arguments in __usercall

i have the following function with five arguments: ; int __cdecl trampolineRegister(void) a4= dword ptr 8 a5= dword ptr 0Ch push ebp mov ebp, esp add eax, ...
0
votes
0answers
584 views

IDA Flair all functions skipped when creating .pat file

I'm trying to create .pat file with IDA Flair tools, but it skips all the functions. Here is what I did: pelf.exe tier0.lib tier0.pat tier0.lib: skipped 395, total 395 I also tried other tools like ...
0
votes
0answers
59 views

A way to detect a anti-cheating system

I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script: debugProcess() -- Attach ...
1
vote
1answer
121 views

Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?

I have the following disassembly which looks like a buffer being populated with zeros in a loop, however, I'm confused at why the alignment is needed here (if a jump will always be 4-bytes, why does ...
0
votes
0answers
68 views

IDA IDC script does not seem to work

I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
1
vote
0answers
55 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
0answers
43 views

How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
0
votes
1answer
117 views

IDAPython Export All Addresses Called by Specific Call

The following call gets executed many times and jumps to many subroutines. call [rbp+var_s38] What do I need to write in the breakline condition to export all the locations it jumps to? import ...
0
votes
0answers
42 views

Address register offsets and analysis (Tricore)

I'm decompiling a binary file for a Infineon Tricore processor, the code is incomplete and only contains part of the code so will not execute. The auto analysis did a great job and the code is ...
0
votes
1answer
234 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
-3
votes
1answer
157 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
9
votes
2answers
2k views

Importing list of functions and addresses into WinDbg

When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in). Since I prefer my kernel debugging with plain ...
2
votes
1answer
136 views

Can I use python3 with IDA 7.0?

Got IDA Pro 7.0 (I can't update at the moment), I'm currently unable to use idapython. I have python3.8 installed on my machine and nothing else (I dont want any collisions). How can I use make ...
1
vote
1answer
196 views

How to extract information from a binary file knowing the target info

I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
0answers
16 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
-1
votes
1answer
126 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
0answers
23 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
0
votes
1answer
27 views

Can't find sequence of bytes in IDA while debugging

While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44: I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
2
votes
2answers
692 views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
2
votes
2answers
1k views

IDA Pro: How to set data size and data length in “Watch List”

When using Watch List(Debugger->Watches->Add watch) in IDA Pro, I want to add a memory scope(data size(db) , data length(18)) into Watch List. However, IDA always only add a dword byte(data size(dd) ,...
-1
votes
1answer
61 views

IDA decompile binary file

how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
0
votes
0answers
51 views

How to reverse engineer structs

I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...

1
2 3 4 5
34