Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

29
votes
5answers
6k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
258
votes
16answers
290k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
10
votes
1answer
3k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
5
votes
2answers
5k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
24
votes
5answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
12
votes
3answers
6k views

Which calling convention to use for EAX/EDX in IDA

I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, ...
9
votes
2answers
1k views

Highlight Executed Basic Blocks in IDA

When I execute a program using IDA's debugger interface, I would like to see the basic blocks that were executed highlighted in the IDB. Is there a way to do this?
10
votes
1answer
438 views

Are those code snippets and file paths in a C++ binary some sort of standard debug information?

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. Is this something standard? (Is this RTTI) If so, how is this called? Are there ...
8
votes
1answer
1k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
8
votes
2answers
3k views

What to do when IDA cannot provide a function name?

For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
10
votes
4answers
9k views

How to find offsets in OllyDBG from IDA

I'm currently trying to gain some practice in RE and I need some help for patching a DLL. Here are my steps: I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
12
votes
2answers
2k views

Detecting recursive functions in IDA

How can I detect/mark recursive functions in IDA? Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
9
votes
1answer
853 views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
6
votes
3answers
476 views

How can I clean up strings built at runtime?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
21
votes
1answer
5k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
13
votes
4answers
5k views

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
29
votes
3answers
15k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
13
votes
1answer
4k views

Is there an equivalent of 'Run trace' as in OllyDbg for IDA PRO?

I have been looking for the equivalent of the "Run Trace" option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?
4
votes
2answers
1k views

How to import Windows DDK headers into IDA?

Currently I'm reversing a Windows driver, and there are a lot of structs IDA doesn't automatically recognize, which means I have to import them manually by parsing C header files. However, there are ...
8
votes
2answers
11k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
7
votes
1answer
2k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
14
votes
2answers
1k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
8
votes
1answer
3k views

Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better

When I decompile using IDA PRO I get code which could look like both of these Understanding the __PAIR__ macro. Macro itself. // The following definition is not quite correct because it always ...
4
votes
2answers
5k views

What is the difference between static disassembly and dynamic disassembly?

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool. But from the using experiences on these tools, I don't think there is any ...
4
votes
3answers
2k views

Does IDA support remote debugging in their Freeware Version?

I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
4
votes
1answer
825 views

How to simplify C++ standard template library in IDA?

I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names sub_xxyz changes to std::xyz, which is as expected. But there are many ...
3
votes
1answer
8k views

how to setup IDA pro linux GDB server

I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
12
votes
5answers
2k views

Artifacts similar to “@YAXPAX@” within memory and IDA sessions

When reversing binaries and parsing memory, I often run across strings like "@YAXPAX@" used to reference procedures. Is there a name for this type of convention? I believe theses strings are symbol ...
3
votes
1answer
361 views

How to get the file format via Idapython?

I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file. Is it possible to get it from idapro?
0
votes
2answers
668 views

Why does IDA show wrong function arguments in pseudocode?

I've open a DLL in IDA v7. In one subroutine, there is a PathAllocCombine() function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. ...
8
votes
2answers
8k views

How do I know the bytes corresponding to an instruction in Hex view in IDA?

When I select an assembly instruction in IDA graph view, I want to see the exact bytes corresponding to the selected instruction when I switch to He view in IDA. How do I do that?
5
votes
1answer
612 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
5
votes
3answers
3k views

Segments in IDA. How to overcome NONAME problem

I'm disassembling a packed 16 bit DOS MZ EXE. To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got ...
4
votes
2answers
2k views

Automating a Decryption function call in IDA Python

I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times. The function takes three arguments and is a simple xor decryption. However it ...
4
votes
2answers
795 views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
3
votes
2answers
309 views

Move twice, from and to the same location

I'm trying to reverse a function and I came across these lines inside the function: 1. call ds:HeapAlloc 2. mov [ebp+var_4], eax 3. mov eax, [ebp+var_4] Why is line 3 needed? If I need to ...
3
votes
2answers
3k views

Is there a way to adjust local variables when a function doesn't utilize ebp?

I have a problem just like in the question. Modern compilers don't use ebp to handle local variables and arguments, they just calculate and add hard=coded offsets to esp. Example: sub esp, 5Eh ...
3
votes
1answer
2k views

How to get the disassembly line without offset translations in IDAPython?

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name. For example, when raw assembly is: mov %r15, 0x20b062(%rip)` GetDisasm()'s ...
3
votes
3answers
3k views

Using IDA cross platform: VM, Wine, other options?

I'm looking to buy an IDA Pro license for my own home use. However, I use all three supported platforms: Windows and Linux on desktop, and OS X on a laptop. I can't afford more than one license, so I'...
2
votes
1answer
988 views

Custom UI buttons

I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
2
votes
1answer
309 views

How can I obtain the data of how many memory references are symbolized by IDA-Pro?

We all know that in typical programs, there exist some references. When compiling, linker will translate all the memory references into concrete memory addresses during the symbol relocation step. ...
2
votes
2answers
817 views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
1
vote
2answers
3k views

IDA - How to transform VA to FO?

I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a ...
1
vote
1answer
1k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
41
votes
1answer
75k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
15
votes
4answers
13k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
7
votes
2answers
5k views

Good training for IDAPython

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
10
votes
3answers
16k views

How to decompile an Objective-C static library (for iOS)?

I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success. I had no problem until I tried to display ...
7
votes
1answer
19k views

How to debug the DLL of an EXE using IDA Pro?

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge. Currently, I'm trying to reverse a ...
8
votes
2answers
712 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...