Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

1
vote
1answer
68 views

While loop function disassembly x86

I am trying to convert this binary to C but I am having trouble with the while loop. What does sub esp, 8 mean? as well as push [ebp+_a] ? I am able to get the esp 8 sometimes while changing the ...
0
votes
1answer
136 views

IDA remote linux Debugger attach to a running process

I usually use remote linux debugger as shown below: ./linux_server bin And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
0
votes
1answer
75 views

How to see all functions that called with debugger

I debugging with IDA, and I want to see/print all the functions that get called. In the functions window I see over than 1000 functions. So I want to see which functions are called when I press ...
1
vote
0answers
112 views

API to force reanalyze of function (Alt-P)

Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml) Is there a way to do this through API?
0
votes
1answer
147 views

How to run ida in windows xp

I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application. I search and found that IDA is not supported with Windows XP. How can I run IDA ...
1
vote
1answer
33 views

idapython cfunc_t.treeitems always empty

I am using the hexray api to get all the items of the AST tree (the ctree) obtained by decompiling a function. Unfortunately, the treeitems vector is always empty. Specifically, the function paaaa in ...
-1
votes
1answer
77 views

Gdbserver and idapro

I would like to reverse a file so of an apk using idapro (on windows) and gdbserver(on remote target device) . I arrived until the attach of the running process. But after? Is there a tutorial ...
1
vote
0answers
130 views

Reverse Engineering Linux Core Dump

I have a Linux Core Dump file for a binary (which apparently crashed during execution) file command on the core dump: core.123: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/...
2
votes
1answer
67 views

Why IDA can't find the function named by windbg

This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like SERVER+0x78123 When I return back to IDA to see the code ...
1
vote
1answer
122 views

Why is the RH850G3K processor missing in my IDA?

Why there aren't RH850 series(like RH850G3K) processors in the processor type list in my IDA? (IDA website says they are supported) I use IDA Pro 7.0
2
votes
1answer
96 views

Is there any way to export breakpoint with IDA Pro?

As the title describes, I'd like to export breakpoints in IDA Pro and load from another project. Is there such feature?
1
vote
1answer
215 views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
3
votes
1answer
150 views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
1
vote
1answer
64 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
3
votes
1answer
122 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
0
votes
1answer
105 views

Searching for a sequence of bytes in IDA

Using an hardware breakpoint, I found with Ollydbg that a crackme was checking for the isDebuggerPresent flag. I'd like to find this part of the code using IDA now. I first looked in the import table,...
3
votes
0answers
88 views

IDA Pro's debugging - Stack view , Register values and ASCII decoding

Below questions are related to IDA Pro debugging: 1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
1
vote
0answers
70 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
0
votes
1answer
86 views

Multiple decompilation failure with ntoskrnl

IDA v7 shows decompilation failure in 64bit ntoskrnl.exe file of Windows 10 build 18262. Here is an example of that: I've loaded all the needed type libraries, PDB file, kernel mode header files (wdm....
3
votes
2answers
137 views

Remote Debugging Linux Binaries - Stack Address Changes?

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro? I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am ...
0
votes
0answers
81 views

Passing input to program in Remote Debugging with IDA Pro

I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
7
votes
2answers
275 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
1
vote
1answer
60 views

Unable to resolve the symbols for a statically linked binary in IDA Pro

I have a statically linked binary which is stripped. When I load it in IDA Pro, I don't see the function names as expected. I generated the sig file for libc on the Linux machine on which the program ...
0
votes
1answer
164 views

IDA Pro is showing Function names for a Stripped Binary

I have an ELF 32-bit binary and it is a stripped binary. Yet, when I load with IDA Pro, I can see the function names like write, open, malloc and so on. So, I am trying to understand if the binary is ...
1
vote
0answers
44 views

What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?

OllyDbg has this nice feature to find the OEP called SFX: IDA has the universal PE Unpacker plugin but it works a little bit different. What is the OllyDbg SFX Feature equivalent in IDA Pro to ...
1
vote
1answer
78 views

How can I update IDAPython for IDA Pro?

IDA Pro currently runs with IDAPython 1.0. How can I update the IDAPython version? Will IDA Pro also run with later versions of IDAPython?
0
votes
2answers
269 views

How to search for Opcode 0xFF25 in IDA Pro?

I want to search for opcodes in IDA Pro like the following: 0xFF25 How can I do that?
0
votes
1answer
56 views

How to see all of my changes in idb?

Is there ant way to see all of my changes in idb file ? All of variable in psudo code that I changed here name, all the funxtion I rename. I want to see all of this
1
vote
2answers
99 views

IdaPython Get Call Destination for Register Operand

I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of ...
3
votes
1answer
178 views

Point-to analysis of IDA Pro

I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro. According to my personal ...
3
votes
1answer
55 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
1
vote
0answers
81 views

Need help understanding IDA Pro pseudocode

I am new into IDA and have some questions about the pseudocode in C. Could someone please explain to me the meaning of the following two lines: (*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
0
votes
1answer
135 views

Analyze raw assembly using IDA Pro

I have a raw assembly dump i.e. .intel_syntax noprefix .bits 32 .global main main: push ebp ... And I know it's Intel x86 and the original function was most likely written in C. Now the ...
0
votes
0answers
57 views

How to get index register from the instruction in IDA?

I have the instruction: add edx, ds:dword_7BFC7A50[eax*4] i.e. add edx, [eax*4+7BFC7A50h] And I decode it via decode_insn(). Then I try to get the information about the second operand. I ...
1
vote
0answers
26 views

IDAPython: Get the operand string without any substitutions [duplicate]

I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset ...
1
vote
3answers
137 views

IDA Debug DLL with non exported function

I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that? Thanks so much./
4
votes
1answer
174 views

Need help identifying main processor for Roland synthesizer

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
0
votes
1answer
49 views

How to convert IDA Pseudo code casts to Array

I have a pseudo code in IDA which is as such consdering v5= 3838385024767399985LL v1 += 53 * *((char *)&v5 + i); In C-Friendly format this should be v1 += 53 * v5[i] Is there any way in IDA ...
1
vote
2answers
196 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
3
votes
2answers
304 views

Move twice, from and to the same location

I'm trying to reverse a function and I came across these lines inside the function: 1. call ds:HeapAlloc 2. mov [ebp+var_4], eax 3. mov eax, [ebp+var_4] Why is line 3 needed? If I need to ...
1
vote
1answer
123 views

How to find out all the locations that call an external function using ida pro?

I just want to find out all the locations that call the standard library function pthread_attr_getstack using ida pro. There is an entry in .plt: .plt:00015894 ; =============== S U B R O U T I N E ...
2
votes
1answer
72 views

Remove Binary from IDA Database

I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
1
vote
1answer
61 views

Windbg's “dt” equivalent in IDA?

I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)? Assuming of course I have the pdb file. Thank you :)
3
votes
1answer
172 views

Find MFC class memory layout automatically in IDA?

Background I was using IDA to reverse engineer an DLL which uses MFC100. I was reading Reversing an MFC application: How to find class memory layouts? and https://stackoverflow.com/questions/...
0
votes
0answers
55 views

How to find first/next instruction in IDA trace via IDC

Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...
2
votes
1answer
115 views

Why having a function with just one instruction

I decompiled a program where there is a function, which has only a single useful instruction which is xor eax, eax retn What it the purpose of having this in an extra function, instead of using xor ...
4
votes
1answer
135 views

How to get execution time of IDC script?

As a beginner I'm trying to disassemble a file with IDA Pro 6.8. I write some IDC script for time-consuming work. Now, I want to get the execution time of my script, but I can not find appropriate ...
1
vote
1answer
109 views

find a dialog in ida using resource hacker

I am having difficulties finding the dialog reference in IDA. e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this: 5035 DIALOG 0, 0, 295, 163 STYLE DS_SETFONT | ...
1
vote
2answers
80 views

Monitor all changes done by function

What is the easiest way to track all changes before and after a specific function is executed. I know I can trace instruction but that may yield a long list of all command executed. I want to stop the ...
0
votes
1answer
162 views

IDAPython Script works from “Script File” but not when run with -S from Terminal

I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....