Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

0
votes
0answers
12 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
0
votes
0answers
18 views

Finding lua addresses with ida

I tried to find lua_pcall, lua_newthread, luaL_loadbuffer, lua_tolstring, lua_pushcclosure and lua_pushinteger functions with IDA decompiler but I didn't find them. Can someone please tell me what is ...
0
votes
1answer
32 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
1
vote
2answers
3k views

IDA - How to transform VA to FO?

I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a ...
1
vote
2answers
78 views

How to identify if buffer allocate on stack or heap?

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer. How can I know if this buffer allocate in stack/ heap?
3
votes
2answers
10k views

How to force IDA to analyze a packed exe after the program has unpacked itself?

I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and ...
1
vote
0answers
21 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
2
votes
2answers
650 views

IOCTL Code for Windows driver

Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
0
votes
1answer
57 views

Show arguments while debugging

I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program. Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
0
votes
1answer
33 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
4
votes
1answer
763 views

IDA Pro: Platform-independent way to check if an instruction is a jump

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures. I thought one may ...
1
vote
0answers
45 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
2answers
105 views

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Update: The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions: .text:00403F2F 074 ...
1
vote
1answer
37 views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
6
votes
1answer
2k views

How is IDAPython API structured?

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
0
votes
1answer
236 views

IDA: NEC V850. Unable to identify anything

I'm trying to reverse a V850E binary (it was extracted from an official update), however, IDA doesn't recognize anything at all. In order to do that, I select a V850 or V850E1 processor type and ...
0
votes
2answers
167 views

What to do when IDA does not recognize return value?

I have a function which fetches the Glide screen width and height and passes it to some set-up function (sub_457048). However, IDA does not recognize that the Glide API function to retrieve the width ...
2
votes
1answer
517 views

Unknown CRC calculation

I am seeking for a CRC calculation on EEPROM content. I try to add options to my car with BOSCH ECU. MCU in this ECU is Tricore TC1793 and EEPROM content seems to be divided into blocks of 128 bytes ...
0
votes
1answer
61 views

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

This question has already been asked here but for some reason it was deleted, as "dead". I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...
0
votes
1answer
61 views

Combine various sub routines into one sub routine (IDA Pro)

Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
2
votes
1answer
68 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
0
votes
1answer
86 views

Multiple decompilation failure with ntoskrnl

IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that: I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm....
0
votes
2answers
138 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
253
votes
16answers
281k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
0
votes
1answer
86 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
1
vote
0answers
22 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
-1
votes
0answers
32 views

IDA Dalvik debugger on Andoid Device JDWP error: INVALID_OBJECT

IDA Dalvik debugger on Android Emulator throws JDWP error: INVALID_OBJECT, and then IDA hangs and not able to figure out why its happening.
0
votes
1answer
72 views

How to detect md5 and sha256?

I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256. How can I detect md5 in assembly? How can I detect sha256 in assembly? thanks
0
votes
1answer
64 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
0
votes
1answer
48 views

ida pro issue debugging issues with ntdll [closed]

I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s I am facing a problem when i try to put a break point on functions in ...
0
votes
1answer
35 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...
2
votes
0answers
134 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
0
votes
1answer
42 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
4
votes
3answers
154 views

How to run part of exe file that is being reversed

I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it. How can I run an exe file from a specific ...
3
votes
2answers
137 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
3
votes
2answers
260 views

IDA Pro: “File is apple protected”

I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message: What does this mean?
0
votes
1answer
55 views

How to see address in Graph view Ida

In Ida when I want to see the address of code I must switch to Text view How can I see the address of code with Graph view ? By the way, is there grapgh viwe in OllyDbg?
2
votes
3answers
1k views

IDA decompiler macro

What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below? double __cdecl sub_401580(float a1) { unsigned int v1; // eax@1 double v2; // st7@1 ...
24
votes
5answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
14
votes
2answers
1k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
1
vote
1answer
59 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
1
vote
1answer
58 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
4
votes
1answer
62 views

Z80 Absolute Jump to offset in middle of instruction

I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another ...
-1
votes
1answer
110 views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
1
vote
1answer
54 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
1answer
132 views

How to export function from exe file?

I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code. How can I export function that I Know the name ...
3
votes
1answer
116 views

How to wrap dump process and execute it in another PC

I debug exe file in Ida , and put breakpoint in some address. I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
0
votes
2answers
123 views

How to identify base64 encode/decode in assembly

How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that? FindCrypt2 Ida plugin not find that
1
vote
1answer
65 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
1
vote
2answers
135 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...