Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0
votes
1answer
503 views

IDA Pro ignores condition in breakpoint

Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
0
votes
1answer
14 views

Does opening a crash dump run a file in memory?

I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
1
vote
4answers
2k views

Tool besides ida to get high level code

I looking another tool besides ida to get high level code from binary file.(like oda pesudocode) I know that the high level is not perfect on every tool, but I want try another tool. My code compile ...
0
votes
2answers
118 views

IDA PRO decompiler expression last question (pseudocode)

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19); ..... shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory; ..... shellcode(&hkernel32, 0) If ...
1
vote
0answers
14 views

Easiest way to move everything, including custom structs, from an IDA Pro IDB to another?

I have analyzed a 32 bit version of an executable, defined many structs, renamed many things and so on. Now i want to move everything, including the structs that i defined, to the IDB of the 64 bit ...
2
votes
1answer
275 views

Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?

I have the following disassembly which looks like a buffer being populated with zeros in a loop, however, I'm confused at why the alignment is needed here (if a jump will always be 4-bytes, why does ...
0
votes
2answers
235 views

Add python to Ida Pro 7.3

I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script. How can I add Python to Ida , So I can run Python script via IDA ?
1
vote
1answer
75 views

How to get function signature using IDA Python in IDA Pro

I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names. I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
0
votes
0answers
23 views

Red color in IDA

Why in IDA the numeric offset next to [ebp- marked with black letters in red background? .text:004015D0 ; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)...
0
votes
1answer
77 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there anyway that , using the assembly code I get from decompiling the game in either Ida or x64dbg , I can locate a function I am ...
1
vote
1answer
47 views

How to move function names, comments, local variable names and structs to a database for a new version of the executable?

I have reversed a number of functions and added definitions for some structs in an Intel x64 PE executable. A program got an update. I moved old executable with the old database into another folder ...
0
votes
0answers
10 views

How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)

In IDA Pro, when you create a custom struct, and apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable it only prints ...
2
votes
2answers
42 views

How to import macro as enum into IDA Pro?

Is there any tools can auto generate enum type by macro? For example, NTSTATUS in Windows defined as #define STATUS_ILLEGAL_INSTRUCTION ((NTSTATUS)0xC000001DL) #define ...
1
vote
1answer
399 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
1
vote
2answers
62 views

How do I find where in the code a particular Windows Resource is used?

I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
0
votes
1answer
101 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
1
vote
2answers
37 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
0
votes
0answers
27 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
2
votes
1answer
54 views

Disable optimization of for loops in Hex Rays Decompiler

Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
-2
votes
0answers
22 views

How can i read offset from branch opcode of thumb mode

I have a function that can make a branch opcode: uint32_t JMPCode(uintptr_t func, uintptr_t addr) { uint32_t code = ((addr-func-4) >> 12) & 0x7FF | 0xF000 | ((((addr-func-4) >> 1) &...
1
vote
1answer
38 views

Double jump when calling functions

I wanted to ask why there is a double jump when calling some functions? For example first call: .text:005AC266 push eax .text:005AC267 call j_WinRegisterWindow ...
0
votes
1answer
38 views

How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?

; PCWSTR __stdcall RtlGetNtSystemRoot() public RtlGetNtSystemRoot RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p ...
0
votes
0answers
20 views

How to change the color of a graph edge and custom hints in IDA

I would like to access the API to change the color of graph edges to reflect my assessment of their correctness (I already know how to do this within the tool, I need to do it programmatically). There'...
1
vote
2answers
653 views

Hex-Rays skips code

I have using IDA Pro 6.8 (Hex-Rays 2.2), the default settings. The problem starts to happen when I'm trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) ...
2
votes
1answer
317 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
1
vote
1answer
55 views

List instructions to fix wrong IDA analysis

I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
1
vote
1answer
52 views

Debugging Native Lib using IDA Pro Fails to Load Registers and other Information

Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
2
votes
1answer
114 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
2
votes
1answer
73 views

How do I reverse engineer structs that are put as parameters in a function

how do I go around figuring out where to reverse engineer a struct? As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
-1
votes
2answers
47 views

Parse offset to PE struct

Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example: I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
2
votes
2answers
79 views

How to restore struct fields

I have an object named ComputeService::RPC that is being used as input in a function inside a binary file: __int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this) pc *...
1
vote
1answer
66 views

Exporting all function addresses from IDA

I have a x86 executable opened in IDA. In the function window you can see a list of all functions with their starting address. My goal is to programmatically export a list of all functions IDA found ...
3
votes
1answer
277 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
1
vote
1answer
72 views

How could I find a call of a function thats only referenced inside a vftable?

So I have this function which I'm trying to figure out the arguments to. However, all the xrefs of it point to a VFTable. How would I find a call for this function?
1
vote
1answer
223 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
2
votes
1answer
2k views

Decrypting Lua Files from game

I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki). Links to files of game: libhellolua.so (cocos2dx external library) example encrypted LUA-scripts (*.abc files) I was reading a ...
2
votes
1answer
91 views

In IDA what does db and dd offset means in data section?

So, in .data section there is some variable, and after it there is db or dd (offset). What exactly does this mean? And what does “align” means? Is there any Wiki or something like that that tells all ...
1
vote
1answer
82 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
2
votes
1answer
110 views

Finding function from pattern

I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find: \x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C \x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
0
votes
0answers
26 views

Injecting class into the JNIEnv in android jni

void *handle = dlopen("/data/local/tmp/libnative-lib.so", RTLD_LAZY); if (!handle) { printf("\nFailed to load library\n"); } void *offset = dlsym(handle, "...
0
votes
1answer
460 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
1
vote
0answers
37 views

How to hide NOPs in IDA?

I am trying to understand a method in IDA Free and I find the NOPs, especially the multibyte NOPs confusing. Is it possible to hide these? I believe that they are not relevant for my understanding.
2
votes
2answers
417 views

How can I find the real function that *(_DWORD *)v2 + 24) points to?

How can I find the real function that *(_DWORD *)v2 + 24) points to? (*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4); int __fastcall sub_1(int a1, int a2) { int v2; // r4@1 int ...
2
votes
0answers
59 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
2
votes
3answers
260 views

How to load a pdb file from the hard drive with IDA Pro?

All the answers I see on Google are about how to load PDB files from online servers. But I have an exe I'm debugging. It's my own exe. Only reason I want to debug it, is so that I can step through ...
1
vote
1answer
181 views

Is this algorithm reversible?

I'm trying to solve a Crackme challenge. It takes my input password and makes the following operations. Finally, it compares the output with 0x1928F914 How to reverse this algorithm to get a valid ...
6
votes
1answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
1
vote
1answer
485 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: Binary ...
1
vote
1answer
53 views

Can I get loaded pdb file path from IDAPython?

IDA Pro can automatically download and load .pdb files from symbol server. And now I want to write an IDAPython plugin to obtain some data from the .pdb file. But I don't know how to get the file path ...
1
vote
1answer
39 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...

1
2 3 4 5
38