Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0
votes
1answer
32 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
3
votes
1answer
712 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
1
vote
2answers
64 views

Bochs x86 16bit and IDA dissasembly

I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says "wrong segmentation". Loading in ...
0
votes
1answer
47 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
1answer
36 views

IDA Pro - Load data in manually created segment

The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string. ...
1
vote
1answer
36 views

IDA debugging a packed / encrypted library - retaining breakpoints / subroutine names set in debug segments

I am debugging a library that is heavily packed / encrypted. Here is a flowchart of the operation of this library and where I am at in my reverse engineering: Assume it is not possible to modify ...
1
vote
1answer
27 views

How to change IDA's name representation programmatically?

I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form 9 dseg_1234 the same as 2, but without data type ...
0
votes
0answers
25 views

Add MessageBox statically modify

So i'm doing this challenge which i have an exe file and a dll all i have to do is modify it statically to pop a MessageBox. The exe file is loading the dll which load the MessageBox, with ollydbg ...
0
votes
1answer
37 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0
votes
0answers
37 views

Which API function is responsible for input strings?

I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
0
votes
0answers
48 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
2
votes
2answers
225 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
0
votes
0answers
31 views

What does mean cs:Memory on IDA pro? [duplicate]

I don't understand the meaning of cs: Memory. Please help me.
1
vote
2answers
2k views

IDA Pro does not recognize function

I am reversing a program with IDA Pro, but for some reason it cannot recognize a function inside the text section. Can someone show me how to reformat the codes (in the figure) as a function?
1
vote
2answers
138 views

Can't find any string with IDA, why?

A friend asked me to make some small mod on a app. The mod should be to rewrite some labels like button, textbox text into his language, so he can better understand the app... I loaded the app to IDA ...
0
votes
0answers
11 views

IDA Pro break on system call to stat64

Upon running strace of an android x86 program I am debugging I notice a large section of stat64 like this: stat64("/data/data/com.topjohnwu.magisk/", 0xbfbf2ef4) = -1 ENOENT (No such file or ...
1
vote
1answer
189 views

find a dialog in ida using resource hacker

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this: 5035 DIALOG 0, 0, 295, 163 STYLE DS_SETFONT | ...
0
votes
1answer
109 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
15
votes
3answers
4k views

How to debug an IDAPython script from within IDA?

IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
2
votes
1answer
97 views

Can Ghidra do backward symbolic execution?

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
0
votes
1answer
49 views

IDA and flirt signatures

I have 2 binaries, with the same CPU architecture. I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it. I put the ...
0
votes
0answers
99 views

Decrypting Lua Files from game

I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki). Links to files of game: libhellolua.so (cocos2dx external library) example encrypted LUA-scripts (*.abc files) I was reading a ...
0
votes
0answers
49 views

IDA free : How to find a string reference in .text

To begin with, I'd like to point out that I'm very new to this. Here's the simple thing I'd like to do : The program I want to mess around with displays a msgbox with the string "Please run the ...
0
votes
1answer
227 views

how can i decrypt huawei HG531s v1 config file?

I have tried to follow this guide but libxmlapi.so didn't have the required ATP_GetInfo1 function so i moved to the next file libhttpapi.so it had ATP_GetInfo1 ATP_GetInfo2 ATP_GetInfo3 ...
1
vote
1answer
251 views

Anti-disassembler techniques and IDA Pro

I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
0
votes
0answers
46 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
1answer
87 views

Identify function in cpp static binary

When I open cpp static binary, how can Identify known function like fopen/ioctl/printf ? They compile statistically into binary I dont know the compiler of this binary .
1
vote
0answers
19 views

IDA losses renaming and functions border data when debugger starts: is there any workaround?

I try to use IDA to debug Android application. As always, I perform static analysis first and rename registers, memory locations, jumps, etc, to make assembly code more readable. However, as soon as ...
0
votes
0answers
28 views

faster kernel debugging in IDA (not VMWARE)

I am debugging ESX server in kernel mode(windows). I use windbg debugging through COM PORT(eventually). Can I get VirtualKD to work in this scenario? Suspending IDA takes more than a few seconds(...
0
votes
1answer
168 views

Calling imported DLL functions from an injected DLL?

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions? I'm able to find the ...
1
vote
1answer
49 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
0
votes
1answer
45 views

IDAPython newbie question

The following call gets executed many times and jumps to many subroutines. call [rbp+var_s38] What do I need to write in the breakline condition to export all the locations it jumps to? import ...
0
votes
1answer
59 views

Remote debugging using IDA, connecting to windbg server (kernel mode)

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
1
vote
0answers
25 views

Debugging arbitrary ARM binary image using IDA and QEMU

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
1
vote
0answers
70 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
2
votes
1answer
195 views

Decrypting Lua Files

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted. ...
0
votes
1answer
42 views

How to remove line? [Help with CTF]

Hi! So, the program print me a Flag length is 32. As I understand call strlen convert my flag to string of length. So, I want to remove that part call strlen or somehow avoid it (maybe I'm not right ...
0
votes
1answer
52 views

Change IDA pro dissassembly to linear sweep

I would like to know if there is any way to modify the algorithm used in IDA pro. I have a binary where I suspect that junk isn't junk, and I would like to see what output would a linear disassembly ...
1
vote
1answer
1k views

Offset Calculation for a Branch Instruction Thumb [closed]

I did find this link: Offset calculation for branch instruction in ARM Which was quite helpful but also confusing for me. I tried few ways to get it working with my offsets but failed. What I wanted ...
1
vote
2answers
59 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
0answers
42 views

Save ida64 database as 32-bit

I accidentally ran ida64 on a 32-bit binary so I can't use the decompiler. Can I save it as a 32-bit database so I can open it in ida?
0
votes
2answers
49 views

Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro

Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis. cseg04:3044 loc_105D4: ; ...
0
votes
0answers
27 views

IDA taking forever to run autoanalysis on remote Android app?

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
0
votes
1answer
29 views

Exported DLL function has only stdcall with some offset

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...
0
votes
1answer
42 views

Why won't IDA let me name this variable?

I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it. The name didn't propagate over to the program, as you can see in the mov ...
1
vote
1answer
28 views

Confused about address being referenced

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
0
votes
1answer
32 views

Building micro controller memory image in IDA

I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format. Some relevant information from the datasheet: ...
3
votes
1answer
281 views

IDA Pro's debugging - Stack view , Register values and ASCII decoding

Below questions are related to IDA Pro debugging: 1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
1
vote
1answer
46 views

Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...
1
vote
2answers
92 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...