Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

1
vote
0answers
57 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
0
votes
0answers
75 views

Finding lua addresses with ida

I tried to find lua_pcall, lua_newthread, luaL_loadbuffer, lua_tolstring, lua_pushcclosure and lua_pushinteger functions with IDA decompiler but I didn't find them. Can someone please tell me what is ...
2
votes
1answer
49 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
1
vote
0answers
45 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
0
votes
1answer
104 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
1
vote
0answers
53 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
1answer
67 views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
1
vote
2answers
142 views

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Update: The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions: .text:00403F2F 074 ...
0
votes
1answer
82 views

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

This question has already been asked here but for some reason it was deleted, as "dead". I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...
2
votes
1answer
86 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
1
vote
0answers
28 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
0
votes
1answer
70 views

Combine various sub routines into one sub routine (IDA Pro)

Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
0
votes
1answer
91 views

How to detect md5 and sha256?

I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256. How can I detect md5 in assembly? How can I detect sha256 in assembly? thanks
0
votes
1answer
111 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
0
votes
1answer
73 views

ida pro issue debugging issues with ntdll [closed]

I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s I am facing a problem when i try to put a break point on functions in ...
0
votes
1answer
43 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...
0
votes
1answer
47 views

Calculate LEA operand

I have those opcodes on 64 bits: 48 8D 35 45 CE FF FF >>> lea rsi, [rip - 0x31bb]. How can I get the 0x31bb value from those opcodes and how can I know if I have a + sign or a - sign ...
1
vote
2answers
134 views

How to identify if buffer allocate on stack or heap?

When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer. How can I know if this buffer allocate in stack/ heap?
2
votes
0answers
144 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
0
votes
1answer
144 views

How to see address in Graph view Ida

In Ida when I want to see the address of code I must switch to Text view How can I see the address of code with Graph view ? By the way, is there grapgh viwe in OllyDbg?
1
vote
1answer
69 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
1
vote
1answer
108 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
4
votes
1answer
69 views

Z80 Absolute Jump to offset in middle of instruction

I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another ...
-1
votes
1answer
261 views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
0
votes
1answer
162 views

How to export function from exe file?

I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code. How can I export function that I Know the name ...
1
vote
1answer
61 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
2answers
179 views

How to identify base64 encode/decode in assembly

How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that? FindCrypt2 Ida plugin not find that
0
votes
1answer
64 views

Show arguments while debugging

I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program. Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
2
votes
0answers
67 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
0
votes
1answer
90 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
2
votes
2answers
160 views

Why are there so much more functions in ida than my source code?

I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
3
votes
1answer
123 views

How to wrap dump process and execute it in another PC

I debug exe file in Ida , and put breakpoint in some address. I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
1
vote
1answer
127 views

Can't find debugger in IDA PRO menu

I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files. This is an example when I didn't load any .exe: This is another example when ...
1
vote
1answer
256 views

How to decompile ARM (iOS) to Objective-C using IDA?

What are the options to decompile ARM (iOS) to Objective-C using IDA? I've been looking into the REobjc module (https://github.com/duo-labs/idapython), but it can only handle x64 code. Are there ...
2
votes
1answer
67 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
4
votes
3answers
171 views

How to run part of exe file that is being reversed

I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it. How can I run an exe file from a specific ...
1
vote
1answer
116 views

What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?

I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
2
votes
1answer
191 views

IDA Dump Memory

I am learning how to use IDC Scripting,or IDAPython in IDA for Reversing binary.One day i face this problem: You are given an array of random integer(4-byte integer) lies within the memory .The ...
3
votes
2answers
118 views

Can't find SetCooperativeLevel call in disassembled program

I am trying to make some changes to the setup program that installs the game "Emperor: Battle for Dune". If you want to look at the EXE I am working on, you can download a copy of this setup program ...
0
votes
0answers
95 views

How is DS register interpreted in x86-64 assembly instructions?

IDA disassembled an x86-64 instruction as below: 0000000000000761 lea rdx, ds:0[rax*4] What I know is, segment registers are only relevant in in segmented memory model, while in ...
0
votes
1answer
200 views

How can I make IDA understand this switch statement with a signed jump table?

I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0: int main() { int a = 0; for (int i = 0; i < 5; i++) { switch (i) { case 0: a = 1; break; ...
0
votes
0answers
87 views

IDA SDK: How to add a struct (pointer) field to a struct?

I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows: 00000000 SomeClass struc 00000000 ...
1
vote
2answers
101 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
1
vote
2answers
147 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
2
votes
1answer
184 views

IDA does not create Vtbl structs for child classes loaded from PDB

I'm decompiling a MFC 4.0 application, and now loaded the MFCS42.PDB from the MFC 4.2 source into IDA 7.0 (not having the MFC 4.0 source) to make it create the appropriate structs representing the ...
1
vote
0answers
95 views

View XMM registers in IDA Pro while debugging

How can I view the XMM registers in IDA Pro? While debugging, I can only view the default registers and eflags. Is there a way to view the XMM registers, xmm0 to xmm7? Thanks.
0
votes
0answers
141 views

Assemble function of IDA Pro not working properly

I am using the Patch Program option of IDA Pro to edit the assembly of a binary at runtime. When I enter the following instruction: mov rax, [rsp + 0x48] I get an "Invalid operand" error from IDA ...
0
votes
0answers
80 views

Getting function arguments with IDA: When do function prototypes exist?

This post explains how to get function arguments using idapython. However, I read here that get_arg_addrs() requires the prototype of the called function to be present. My question: In which cases ...
0
votes
0answers
67 views

How to remove all goto statements in pseudocode?

IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...
2
votes
1answer
172 views

How to load firmware x86 BIOS into IDA Pro 7.0

I have a file called bios.bin which is the firmware of an ATM machine and I have found out it is x86 code 16-bit. But I don't understand how I'm supposed to set the base address in IDA Pro for an x86 ...