Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

1
vote
1answer
64 views

IDA plugin to view hex bytes similar to objdump

Is there a plugin or option in IDA that interleavs the hex bytes for each instruction similar to the output of objdump? I.e. like this: 1800035f1: ff 15 19 5a 00 00 callq *0x5a19(%rip) ...
0
votes
2answers
160 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
1
vote
1answer
287 views

Understand hardware breakPoint option in ida

When I set a hardware breakpoint I see the following dialog: I understand that Read/Write is meant to break into the debugger when the address that I choose for the breakpoint is read or written. I ...
3
votes
1answer
142 views

Why IDA define negative offset?

a = byte ptr -19h Why offset from stack base can be a negative number ? Can anyone explain this for me please?
1
vote
1answer
82 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
1
vote
5answers
4k views

Older versions of IDA free?

I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither. Does ...
0
votes
1answer
58 views

immediate value change when start debugging

I patch the code for my work. I have a problem with code patching. I use IDA pro 6.8. I added code like this. (Assembly) (Hex dump) mov eax, 638BACh --> B8 AC 8B 63 00 Not problem ...
2
votes
1answer
278 views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
1
vote
1answer
619 views

How to find V-Table in IDA? (Using class informer)

I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do). But how do i find them in IDA? I'...
2
votes
1answer
79 views

IDAPython Code <-> Data

I'm looking for a way, to make programmatically change of data type. This is the same as you press 'C' or 'D'. For example convert this: .text:00401008 unk_401008 db 55h ; U ; ...
2
votes
2answers
380 views

IDA PRO run patched program from debugger without creating new exe

Using IDA PRO, after making a few patched, can I run the patched program in the debugger? What I have been doing so far is: 1. Edit > Patch Program > Apply patch to input file… 2. Save in a specific ...
-3
votes
1answer
106 views

Change value of an IF condition found in IDA

so I have the .idb file of an executeable I want to modify. In the IDB file, I found this code And I basically want to change 4111006 to 1006 in that IF condition. however, when I press TAB to go to ...
2
votes
1answer
146 views

IDA PRO “try{” comment

2 related questions: I noticed that in some of the blocks in the graph there are more branches that I would expect. These are not jump tables yes I see, e.g. 3 possible branches. How come? The 2nd ...
0
votes
1answer
342 views

Resource Hacker and IDA PRO

How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH). e.g. I find, in RH the following Menu items: POPUP "Painter" { MENUITEM "Start/Continue", 32840 ...
4
votes
1answer
128 views

Load .IDL / TypeLib into Ida Pro

I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool). Is there a way to load the ...
1
vote
1answer
139 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
511 views

IDA PRO - .id0: b Tree error: file open error: permission denied

Many times after closing a file I am working on and trying to open it later I get an error: <fileName>id0: bTree error: file open error: Permission denied even when i copy this file to a new ...
1
vote
0answers
130 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
1
vote
1answer
108 views

IDA PRO does miss calls when tracing

I am following this tutorial: enter link description here Though it uses Olly I am following with IDA. Basically i am tying to catch where a popup decision is taking place in the program. I though ...
0
votes
1answer
142 views

When to create a keygen versus when to bypass the security jumps

I am a newbie reverse engineer. I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
2answers
169 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
1
vote
1answer
127 views

How to watch communication between 2 processes?

I have exe file in my pc(exe1) that send message to another exe (client-server maybe). I dont know which exe recived this message from exe1 and with which iso that message encoding. How can I see ...
1
vote
0answers
47 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
1
vote
1answer
142 views

FLIRT Signature Applied, IDA shows references but no auto rename?

So, I have a program which I am 99% sure it is using Lua as when I look at string references I see this: Which I am understanding that somewhere in this program they have statically linked a Lua C or ...
2
votes
0answers
106 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
1
vote
1answer
95 views

Data moved after program rebase

Consider the following piece of code: .text:00F74B42 call sub_12D1130 .text:00F74B47 mov eax, dword_15A0C80 Now, I want to add a sanity check but as I don't have enough space to do that I ...
1
vote
1answer
102 views

Why doesn't IDA break on the WriteFile function?

I searched all places in IDA that call the imported WriteFile function and put a breakpoint on them. But while debugging I saw with ProcMon that my exe wrote to the file but even though it did not ...
5
votes
1answer
183 views

What's the meaning of dword_XXXX and offset dword_XXXX in IDA?

Consider the following code: In C++: SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized void someFunction() { globalPointer->...
0
votes
1answer
34 views

What is the difference between xrefs and stack trace?

In IDA, I can see what calls a specific function by looking at the xrefs to it, or by looking 1 step back on stack trace. What are the differences between them? How does IDA know what the stack ...
3
votes
2answers
102 views

IDA function never called and only cross-referenced as data

When I press the X key (list x-refs) on a function (sub_xyz) to see which functions call it, I only saw dd offset sub_xyz twice, with no call sub_xyz instructions. There is no another place that ...
0
votes
1answer
138 views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
0
votes
1answer
86 views

Keygenme - Key location

So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction: ...
2
votes
1answer
43 views

How to change immediate to reference using IDA API?

i.e. What is the IDA API equivalent to pressing 'O'?
-1
votes
1answer
54 views

How to use Python while debugging in IDA

I'm debugging an .exe file in IDA. At a specific point during debugging, I want the Python code to automatically take the data in *(eax+8) and encrypt it with that module and print the result to file ...
2
votes
2answers
1k views

What is the difference between IDA and OllyDbg?

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA? In IDA, I'm using the WinDbg debugger back-end.
1
vote
1answer
72 views

What are these LOAD segments in an assembly ELF64?

I wrote the following (fasm) assembly program: format ELF64 executable segment readable executable include 'io.inc' include 'unistd64.inc' entry main main: mov rdi, msg call print call ...
3
votes
2answers
142 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
1
vote
1answer
143 views

How debug process that not started with ida? [duplicate]

I am trying to debug two different exe files,in windows. The first exe launches the second, and the second exe doesn't work well unless the first starts it. I want to be able to debug the second exe....
1
vote
1answer
460 views

Installed IDA 7.0 Freeware — no debugger, is that installed separately? [duplicate]

After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
1
vote
0answers
55 views

Trace back Offset Function

I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position. Thanks! Offset ...
0
votes
2answers
193 views

How to breakpoint exe tcp packet

I am debugging an executable in windows with IDA. My exe sends a TCP packet and I want to see which function it uses to send the packets. I looked on the import tab and haven't found any function ...
2
votes
1answer
336 views

How to find start of .text section?

i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it ...
1
vote
0answers
101 views

IDA fixups, why and how

I'm using IDA 7 Freeware, not Pro. I've been using IDC to re-invent the wheel somewhat, but I'm learning a ton of stuff as I go along. I have a 16-bit MSDOS exe which I'm reversing. I stripped out ...
3
votes
1answer
105 views

Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?

I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened it with ...
1
vote
2answers
249 views

Lea instruction on datasegment

I wrote simple program(was built in release mode(x86)) to practise re skills but I can not understand one part of it. C++ program: int doSub(int a, int b) { int result = a + b; result -= 2;...
1
vote
2answers
111 views

How to stop debugging while a specific value is on the stack?

I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF . That value interests me, I want to know where this value comes from, how it gets pushed onto ...
2
votes
1answer
242 views

How to see all my comments on idb file

I add some comments to exe file with ida(save on idb). Is there any simple way how to see all my comments in 1 windows?
1
vote
2answers
94 views

How to refer to the same call on separate IDAs

When I open an .exe file in IDA, each time I get a different function address because each time I get a different base address offset. So if I open an .exe file with IDA and want to tell a friend "...
1
vote
1answer
303 views

How to find the executable code of the native method in the library * .so? (Android)

I'm doing reverse engineering of a mobile application for android and I had a question how to find the executable code of the native method in the library * .so. From the code of the code, the native ...
1
vote
1answer
584 views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...