Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0
votes
0answers
147 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
2
votes
1answer
103 views

IDA “unk_XXXXXX” meaning? [duplicate]

I am new to reverse engineering. Today when looking at IDA, I found this if ( *(_UNKNOWN **)(this + 8) == &unk_4EDC58 ) but I dont understand the part "unk_4EDC58". So can you help me ? Thank ...
0
votes
0answers
19 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
1
vote
0answers
35 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
48 views

How does Ida suspend threads?

I know that Ida uses ptrace function to attach and debug process. How Ida can suspend thread? how is that possible?
0
votes
0answers
18 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
1answer
46 views

In IDA, i want to get symbol by using IDAPython

I'm currently reversing some C++ Binary (macOS Kernel Extension). But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython. I know how to make structure ...
0
votes
1answer
83 views

IDA pro - strange switch statement

I use IDA pro and along the analysis I try to understand the following function. There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing. Am I missing ...
0
votes
0answers
184 views

Anti-disassembler techniques and IDA Pro

I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
0
votes
1answer
480 views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
0
votes
1answer
149 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
1answer
58 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
0
votes
1answer
139 views

Unable to decompile C Code

Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the ...
2
votes
2answers
198 views

Use idapython to print register or memory value when the debugger is running

I want to record the value of a certain register or specific memory location when the program is being debugged. e.g. in the following segment: .text:0FD6268D shr ecx, 4 .text:...
1
vote
1answer
60 views

GUARD_PAGE memory breakpoints with gdb?

I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)? Ollydbg, x64dbg and IDA PRO all support these types of ...
0
votes
1answer
142 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
1
vote
2answers
115 views

Permanently load a DLL to an executable

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger. I've learnt that ...
0
votes
1answer
36 views

Is it possible to import an open source framework into a closed source project in ida?

I am working on reversing a closed source project that uses a well known open source framework. I am thinking that theoretically, by diffing the program and the framework, I should at least get a few ...
2
votes
1answer
93 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
0
votes
1answer
97 views

IDA PRO Tracing stopps

I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
0
votes
0answers
68 views

How to disassemble .mbn files?

I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ? I want to reverse qcom bootloader
0
votes
2answers
84 views

Stop currently running Ida Script mid execution

I ran an ida script and forgot to account for an infinite loop that keeps making a dialog pop up. Is there any keyboard command that will stop an Ida script from running mid execution? Thank you. I'm ...
1
vote
0answers
30 views

IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)

I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these: Copied linux_server form IDApro into this VM and tried to run it, ...
1
vote
1answer
109 views

Tool to search known hash/encryption algo in files in Windows

I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.). I know an Ida plugin called FindCrypt2 but ...
1
vote
0answers
55 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
1
vote
1answer
82 views

How to get IOCTLs from all NtDeviceIoControlFile function call?

Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from NtDeviceIoControlFile() syscall. Here is an example of that syscall in Beep() function in KernelBase.dll file: In x86_64 (...
2
votes
1answer
77 views

Get all ordinals from local types view [closed]

Is there a way to get all ordinals of the local types view with the ida python api? i have tried to get all ordinals for structs with: [ida_struct.get_struc(id).ordinal for _, id, _ in Structs()]. ...
0
votes
0answers
21 views

SIGBUS when trying to trace functions?

I am working on a crackme (Mach-O, mac app). Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
1
vote
0answers
43 views

IDA map one memory address to another

I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
1
vote
0answers
69 views

Can anyone make much sense of this binary for an embedded system? [closed]

I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it. ...
1
vote
2answers
59 views

IDA - floating point operand type

How do I set the data to floating point number in quickier way than clicking on: Edit>Operand type>Number>Floating point I have a lot of wrongly detected casual DWORD's instead of Float's ...
0
votes
1answer
36 views

How to make IDA load headers of object files?

When I open an executable (a.out), I can see header info: But when I load an object file, headers and segments aren't loaded: The entire header section is skipped. It goes directly to main (starts ...
0
votes
2answers
70 views

IDA Pro not undefining assembly?

I am not sure if IDA is working correctly or not. I have the instructions call $+5 pop edi If I understand this correctly, the program will jump forward, skipping some junk interpreted as ...
0
votes
1answer
71 views

Why Ida pseudo-code translate test as AND?

In IDA when disassembling a x86 EXE file there is a line test byte ptr [ebp+XXX], cl Before this line cl has a value of 0x11 The Hex-Rays decompiler plugin translates it as if (v10 &0x11). Why ...
1
vote
1answer
307 views

Recommended way to modify assembler instructions in IDA

What is the easiest way (or is there any) to modify an instruction inside a binary opened inside IDA and save the changes to the original? Is there a builtin assembler who's output I can place at a ...
0
votes
0answers
51 views

Handling __int64 in IDA?

This is probably something very easy that I'm missing. I have this operation length_of_userInput = (signed int)(unsigned __int8)userInput >> 1; And length_of_userInput is currently reading '...
0
votes
2answers
70 views

Bitwise operation between byte and 1?

I am having some trouble understanding what this is doing. This is the commented pseudocode. mightGetUserInput(&std::__1::cin, &userInput) ; this fills the buffer with the user input, ...
0
votes
1answer
146 views

Calling imported DLL functions from an injected DLL?

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions? I'm able to find the ...
0
votes
1answer
37 views

How do I set the return type for this type declaration?

I have a function that seems to calculate the length of a string. I have made this type declaration and it does kind of work as IDA now flags the string correctly. __int64 __fastcall strlen(char ...
0
votes
0answers
70 views

What is this function doing?

I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm. And this is the relevant assembly: mov rdi, [rbp+var_A80] mov rsi, [rbp+var_A88] ...
0
votes
0answers
28 views

How to generate .TEXT only asm output in IDM?

So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
1
vote
0answers
74 views

How can I see specific memory value by using Hex view in IDA?

I'm about to use IDA pro. I have to access to 0018F42C(EAX) by using Hex view in IDA. Maybe I guess there is EAX value.(String is "happyy", standard input) but Hex view shows me 0018F410 as in screen1....
0
votes
1answer
175 views

Tricore debugging tools

I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM. Now I would like to learn about Tricore reverse engineering... ECUs mainly. I can obtain the ECU ...
1
vote
0answers
47 views

Saving IDA Graph to PDF format?

I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that? I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
1
vote
0answers
92 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
0
votes
0answers
137 views

Finding lua addresses with ida

I tried to find lua_pcall, lua_newthread, luaL_loadbuffer, lua_tolstring, lua_pushcclosure and lua_pushinteger functions with IDA decompiler but I didn't find them. Can someone please tell me what is ...
2
votes
1answer
74 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
1
vote
0answers
92 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
0
votes
1answer
411 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
1
vote
0answers
61 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...