Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
This site is currently in read-only mode; we'll return with full functionality soon. Follow @StackStatus or visit our status blog for more info.

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

-2
votes
1answer
425 views

How to install ida plugin to identify encryption function

I saw here How to identify known encryption algorithm? the IDA plugin https://github.com/nihilus/IDA_Signsrch I don't understand how to install it . In the INSTALL I saw coppy the plug-in and ...
3
votes
0answers
105 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
4
votes
1answer
282 views

Resolving FLAGS bits with IDA

While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
0
votes
1answer
58 views

Figuring out where 2 executions of the same process differ

I have a process that runs and does it's job sometimes (takes some files and does some work). However when I feed it some incorrect files, it fails. I'd like, if possible, to record every step the ...
2
votes
1answer
117 views

Ida break point on address changed

How can I set break point when the value on specific address is changed while I debug it with ida
0
votes
1answer
163 views

Translating ida macros and pseudocode into C++/C

What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh v8 = (...
6
votes
1answer
1k views

Is IDA pulling my leg - or can REX.W sometimes not be determined in static analysis?

NB: I normally dabble with disassembly (i.e. mnemonics) and only ever look at the raw opcodes when I can't avoid it. I have the following line of disassembly of a Windows x64 kernel mode driver, ...
2
votes
2answers
104 views

How to get closing message from IDA Pro?

Is there any way to get SDK API message when Ida Pro is closing? I write plug-in that connect with other application and I need to close connections when IDA is closing.
2
votes
1answer
525 views

How to identify known encryption algorithm?

I reverse an .exe file with IDA. I see a function that appears to be encrypting something by generating some random numbers. It there any tool to identify if it is a known encryption algorithm?
1
vote
1answer
67 views

How do I reset the “don't ask me again” checkbox in an IDA popup?

I was just debugging something in IDA and it told me that the instruction pointer was pointing into the middle of an instruction, and asked if I would like to have it disassemble the middle of the ...
4
votes
1answer
448 views

How to make type libraries from Windows 10 SDK and DDK?

I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: ...
1
vote
1answer
149 views

How to move one step back in a debugger

When I debug a .exe file on Windows with IDA, I do it step by step. Can I move one step back and reset all the registers and stack to what they were one instruction ago? By the way, when I'm looking ...
2
votes
2answers
370 views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
65 views

How to identify when a function is being called using IDA?

I'm debugging a .exe file on Windows with IDA's debugger. How can I identify when the code calls the random() function?
1
vote
1answer
63 views

Fixing up data sections of a malware sample in IDA database?

I have a piece of malware dumped by segments. A lot of the data section seems to be screwed up when loaded into IDA Pro. First of all, pointers are stored in a single array which is incorrect. I want ...
4
votes
0answers
239 views

IDAPRO from command line interface: Exporting IDB file to BINEXPORT file

I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: "<path-to-idaq.exe>" -A -OExporterModule:<result-...
1
vote
2answers
264 views

How identify witch cpu run assembly [duplicate]

I have around 300 bytes of binary machine code. I don't know which instruction set the code is for so I can't open it with IDA. Is there any tool that can help identify the instruction set?
1
vote
2answers
661 views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
1
vote
0answers
92 views

Getting R6034 error message when starting IDA Pro

I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
3
votes
2answers
95 views

How do you look for a a particular value at address in IDA

So, I was trying to load some binary and in the main function, I saw instructions such as mov edi, [esi+1Ch] ... lea eax, [esi+18h] So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
1
vote
0answers
53 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
4
votes
1answer
175 views

Help understand decompiled IDA code

I got stuck at yellow lines, dont understand what it's gonna do. Need advice or help, thanks! File : https://www.sendspace.com/file/3yowjg Password : 1 void __fastcall sub_A513C0(char *Src, HWND ...
0
votes
1answer
300 views

IDA: NEC V850. Unable to identify anything

I'm trying to reverse a V850E binary (it was extracted from an official update), however, IDA doesn't recognize anything at all. In order to do that, I select a V850 or V850E1 processor type and ...
4
votes
1answer
96 views

Automatically find intput required to trigger a specific code path in a program

Assuming I have the following scenario: I have spotted a vulnerability in a specific function deep inside of an executable (DLL). To get that code path executed (in a vulnerable context) I need to ...
4
votes
1answer
126 views

Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?

The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption. Does any one recognize this pattern? Is it maybe some kind of ...
1
vote
1answer
274 views

Is IDA resolving ELF relocations correctly?

While working on this kernel module, I noticed IDA somehow resolves some ELF relocations statically. Consider the symbol sys_renameat, which, according to IDA, resides at 0x8000720 in .bss segment. ...
4
votes
1answer
825 views

How to simplify C++ standard template library in IDA?

I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names sub_xxyz changes to std::xyz, which is as expected. But there are many ...
11
votes
1answer
240 views

What is the meaning of single letters in IDA's functions window?

IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture. The characters are: ...
1
vote
1answer
619 views

IDA Pro: Is there a command-line way to generate idb files without generating asm files?

Currently, I'm generating a bunch of .idb files in a batch via idaw.exe -B <FILE>. (I'm using IDA Pro 6.8.) This process also creates many .asm files - one for each .idb file created. I don't ...
2
votes
1answer
266 views

IDA 7 does not recognize/reference Delphi 16bits Strings correctly

I am dabbling with a XE3 Delphi application in IDA 7.0, and can't get Strings representation to work correctly: While selecting Delphi (16 bits) in the Strings Window yield correct results: ...
2
votes
1answer
82 views

What does __return_ptr do in IDA?

Let's say I have this program: struct A { int x; }; struct A func1(int z) { struct A result; result.x = z+1; return result; } int main() { return func1(1).x; } When compiling ...
1
vote
0answers
46 views

how can i get real hex values of vdso outputs [closed]

I'm trying to get an algorithm in a program but i can't see the hex codes. At the moment i break all debug checks it fully debugging but i can't see how it creates the request.
1
vote
1answer
145 views

How can I fix the problem of IDA view and corresponding HEX view not being in sync?

When I place my cursor on an instruction (on the address, opcode or operand) in the IDA-view, and switch immediately to HEX-view, I expected the hex bytes corresponding to the instructions to be ...
3
votes
1answer
270 views

Counting number of nodes and edges in IDA Pro graph

Is it possible to obtain a node and edge count for the IDA Pro graph overview? I'm able to obtain this if I generate a wingraph32 flowchart, but it seems that wingraph32 doesn't work for very large ...
0
votes
1answer
122 views

Reversing: DeviceIoControl return value

While reverse engineering a windows executable I found the DeviceIoControl function, and i'm trying to figure out the correct inputs so it does not return a zero, it get's the [ebp+hDevice] from the ...
1
vote
3answers
159 views

How do I load an executable into IDA without it correcting relocatable references?

I am working with a dumped program, and I essentially want to load it into IDA without performing any (relocation) address fixups. Is there a way to do this? I have tried the following without ...
-1
votes
1answer
66 views

Why would MSVC pass a constant “2” for an unused this parameter?

Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2 And by my following of the ...
1
vote
1answer
272 views

How do I resolve IDA pro Hexrays aliased local variables?

It appears to me that in my function the compiler has reused a stack slot for two variables of types. However, Hex-Rays has not recognized it as such. How can I split the local variable into two?
1
vote
1answer
82 views

Build Graph Printable String Information in ELF

I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
-1
votes
1answer
72 views

Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?

I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this https://github.com/binrapt/ida but when I load it in ida, it complains about "No ...
1
vote
1answer
277 views

Reading from text file and printing it in IDA Pro

I have a text.txt file and I want to read it and print its content in the Output Window of IDA Pro (Free version). I wrote an .idc script as follows: #include <idc.idc> static main() { ...
3
votes
3answers
523 views

IDA: add segments without losing data

I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure. ...
1
vote
1answer
420 views

IDA 7.0 (freeware) auto-analysis gets stuck in a loop

I am trying to create a graph so that I can visualize the flow of a particular function in a game that I am interested in. I was initially using Cheat Engine to follow the flow of the function, but ...
4
votes
2answers
171 views

Backtracing where a register gets initialized

I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified. Short explanation of the crc32 ...
-1
votes
1answer
176 views

What are these sub_XXX things in IDA's disassembly?

What are these things I marked in red circles on the screenshot? In this program which i tried to disassemble there are 1427 of them. Is there any other application to view it in a better way ?
4
votes
2answers
338 views

idapython - assign a struct to a stack variable

I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
4
votes
1answer
254 views

How to specify stack-based return values in IDA Pro (GoLang)

tl;dr: I am reversing a GoLang 1.10 executable, compiled for Windows. I am trying to make IDA correctly recognize the calling convention. Details: I am looking at an x86 executable where the ...
2
votes
2answers
782 views

Confused about the value of edx and eax registers used at function entry

I am currently using IDA to disassemble a keygen. In the first few lines of a specific function before the eax and edx registers are given a value, their contents are moved to stack variables var_40 ...
-1
votes
1answer
153 views

Fixing IDA Member functions argument order

When IDA realizes a function relies on the this* pointer it often places as the second variable. Severely mucking up things. I was wondering is there away to fix this and maybe in turn help type ...
2
votes
1answer
189 views

How to do i fix it when IDA pro mislabels values as loc_

Some times the psuedo code generated by IDA is baffling v8 = (signed int)&loc_100010; //ida v8 = 0x100010; //actual code This is not so bad when it is just one value but sometimes the offset for ...