Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

2
votes
2answers
546 views

Confused about the value of edx and eax registers used at function entry

I am currently using IDA to disassemble a keygen. In the first few lines of a specific function before the eax and edx registers are given a value, their contents are moved to stack variables var_40 ...
-1
votes
1answer
135 views

Fixing IDA Member functions argument order

When IDA realizes a function relies on the this* pointer it often places as the second variable. Severely mucking up things. I was wondering is there away to fix this and maybe in turn help type ...
2
votes
1answer
144 views

How to do i fix it when IDA pro mislabels values as loc_

Some times the psuedo code generated by IDA is baffling v8 = (signed int)&loc_100010; //ida v8 = 0x100010; //actual code This is not so bad when it is just one value but sometimes the offset for ...
0
votes
1answer
311 views

IDA Pro v7 installation problem in VM

I have different problem. I created VM (windows7x86SP1) with VMware Fusion on Mac OSX. When I try to install IDA Pro, I have a such a error. But I couldn't find any solution. I removed VM than ...
-3
votes
1answer
271 views

Identification of AES portion code in binary

I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
-2
votes
2answers
158 views

Some question about IDA [closed]

This binary was from a CTF challenge. I found 2 way to solve this, one is run & debug the bin, set a break point and see result in flag after the bin running, another is trying to understand the ...
1
vote
1answer
190 views

Hex-Rays can't parse switch (bad target for case)

I need to add new case, so here is that I do. Copy the jump table for switch statement to 0048199C and add new ref to 4819C0. Add new instructions below Set new address 0048199C In the indirect ...
0
votes
1answer
128 views

Know which bytes are opcode and which operands in IDA

I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands. Example: From the first instruction I want to know the bytes ...
0
votes
0answers
19 views

Is there a way specify the limits of addresses which IDA should try to analyze as pointers? (ARM)

It seems like IDA has some hardcoded limit at 0x80000000, so that it wouldn't try to resolve pointers at addresses higher 0x80000000. I.e. I have a firmware which loads at 0xC0008000, but IDA won't ...
3
votes
2answers
260 views

IDA Pro: “File is apple protected”

I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message: What does this mean?
1
vote
2answers
72 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
0
votes
1answer
182 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
6
votes
2answers
341 views

Split variable in Hexrays decompiler?

With Microsoft Visual C++ executables, I often run into decompilations like this: void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength) { Pbdf *pbdf; // esi pbdf = pbdfOrLength; ...
2
votes
1answer
130 views

IDC: Get structure id under cursor in “Structures” window?

I'm writing an IDC script which accepts a structure and does some processing. Currently, I have to call it by typing structure names. What I want is to make it use the structure under cursor in "...
1
vote
0answers
65 views

IDA sdk delete user struct member prevent creating gap

I have a problem using IDA SDK function del_struc_member(struc_t *sptr, ea_t offset) , If i use it on a member, it creates a gap[4] on the offset ( for dword type), it doesn't recalc the struct and ...
6
votes
2answers
273 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
4
votes
1answer
396 views

IDA: Changing type of arguments to local type

I have functions foo_0(...,_ v0,...) foo_1(...,_ v1,...) ... And, for each (foo_x, _ v_x) pair, I would like to change the type of v_x in the declaration to ANIMAL *, where ANIMAL is a local type. ...
2
votes
0answers
98 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
1
vote
2answers
693 views

How to skip on int 3 when ida debug?

I tried to debug a windows application, but when I debug it with Ida, it stopped on int 3 instruction. I read that int 3 catch debugger so I cant debug. How can I cancel this int 3? How call to int ...
2
votes
1answer
1k views

IDA Pro's Debugger option disssapears

So, I have this problem: I'm trying to do a homework which, at one point, asks us to use IDA to debug a simple program step by step. The deal is, when I load the executable in IDA, the Debugger option ...
1
vote
1answer
216 views

identifying function prototype from dll

I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution. So my requirement is to create a program ...
0
votes
1answer
72 views

Cant debug software with ida [closed]

I have software that run on windows well. I tried to debug it with IDA (local win32 debug) but when I start it I see that exeption throw and I cant debug it. I dont use breakpoints Is that anti ...
0
votes
1answer
208 views

IDA SDK - Rename Variable permanently

I'm using ida 6.8 SDK and i have an problem with saving changed variables names, I used many functions like set_reg_name(C++), setMemberName(in python), they change the name but not permanently, ...
7
votes
1answer
1k views

How do you search for unicode strings?

In all versions of IDA, I can't seem to be able to search for unicode strings. When reversing programs, I constantly see unicode strings that could have really helped if I could see them in the ...
1
vote
1answer
262 views

Break on driver loading with windbg

I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
0
votes
1answer
387 views

How to set defualt processor on IDA

I open binary file with IDA and each time I need to choose my processor.(by default I see different processor than I need) How can I choose default processor(cpu) that each time will be choosen when ...
-1
votes
1answer
341 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
-2
votes
2answers
126 views

Looking for reverse engneer online course [duplicate]

I looking for online reverse engeneer course. Course that study ida,reverse and patch for windows/ linux. Working with ida and another tool. I like many videos lesons. Do you know one?
2
votes
2answers
651 views

IDA Pro - how to export a listing file in batch mode

I am using IDA Pro 6 and I'm looking for a way to automatically export an analysed file into a listing (.lst) file. The interface of IDA enables to do this action using the menu File > Produce File > ...
0
votes
1answer
299 views

How to convert pointer and offsets to array in IDA?

Here is an example of a subroutine as pseudocode in IDA: HRESULT __stdcall func(PCWSTR name, PCWSTR command, BOOL folder, DWORD *pCode) { _OWORD *v4; __int128 v5, v12, v13; __int64 v6; ...
1
vote
1answer
63 views

Is there an IDA disassembler module for IBM 360/370/390?

Has anyone written an IDA disassembler module for IBM 360/370/390 or higher processors? Would like to examine one even though i cannot afford IDA Pro.
2
votes
1answer
188 views

Hooking function with C++, IDA and .pdb file

I want to call a function in a program. I do this from a DLL entry point. I opened the program in IDA together with its .pdb file. This is what the function looks like according to IDA: void ...
0
votes
2answers
188 views

Help reversing code which uses ATL::CStringT

I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code. IDA found ...
0
votes
2answers
570 views

Why does IDA show wrong function arguments in pseudocode?

I've open a DLL in IDA v7. In one subroutine, there is a PathAllocCombine() function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. ...
0
votes
0answers
61 views

IDA Bug negative operand in pseudocode

For some reason IDA 6.0 Pseudocode view doesn't support constant values bigger then 159, as a result IDA invert bits to negative and apply them over constant value. In example below 160/A0h turns in -...
-1
votes
0answers
269 views

IDA remote debugger on linux “input is a dynamic library…”

I am trying to understand how to debug with the remote debugger of IDA on linux. I tried to debug the bof challenge of pwnable.kr (http://pwnable.kr/bin/bof). It is a 32-bit ELF, so I could not run ...
0
votes
1answer
162 views

Is this obfuscation?

I'm trying to reverse a binary with IDA and it seems to be obfuscated, I have a variable: "EnableTeleportEffect" that I want to modify the values of later. When jumping from the strings window, this ...
1
vote
1answer
207 views

How can I mark a global variable as an offset using IDAPython?

I have a four byte global variable that is a pointer to some other data. How can I mark this to be an offset (like pressing o) using IDAPython? .text:00436FF3 dd 43702Ch ida_offset.op_offset_ex ...
1
vote
1answer
587 views

How can I set an address to be a relative offset pointer in IDA Pro?

I have the following sequence of bytes in IDA Pro: .text:0044A838 db 2Ah .text:0044A839 db 0ADh ; ­ .text:0044A83A db 4 .text:0044A83B db 0 .text:0044A83C ...
0
votes
1answer
52 views

Why IDA shows return statement in separate subroutine?

IDA shows this following code in separate subroutine. Assembly: sub_180049410 proc near jmp rax sub_180049410 endp Pseudo-Code: __int64 __usercall sub_180049410@<rax>(__int64 (*a1)(void)...
1
vote
0answers
213 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
1
vote
1answer
114 views

De-obfuscation - Emulation-oriented vs Script-oriented

What are the advantages of each method when employing de-obsfucation of potentially malicious code? I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
1
vote
2answers
2k views

How is a keygen made by reversing a software? [closed]

I know that a software is cracked by reverse engineering it and reading it's assembly code... My question is how and what do crackers look for in the assembly code? And how do they know what algorithm ...
0
votes
1answer
320 views

How to force IDA pro to list some bytes as a specified instruction?

Please first read this My previous question, and then continue the following: **** The binary file size loaded into IDA is 0x1e400 = 123k, and when I try to only change the "Loading address" to ...
1
vote
0answers
167 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
2
votes
1answer
183 views

How to modify strings and funtions reference detection in IDA pro?

I have loaded a binary file into IDA which is for Motorola 6800 series. The strings are referenced like this: pea ($2017A99).l. The actual address of the referenced string in above command is ...
0
votes
1answer
236 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
1
vote
1answer
55 views

IDA SDK: Event when database created / opened?

I'm writing a plugin which is available at all times (PLUGIN_FIX flag). However, I also need to be notified when a database is created or opened, as if I would handle the moment when init() is called ...
1
vote
1answer
2k views

IDA 7.0 not recognizing plugins (Eg. ScyllaHide, IDAStealth)

The problem I'm facing with the latest version of IDA (as of now) which is 7.0 is that it doesn't recognizes plugins, not even adding them in its Edit > Plugins menu tho this was not happening in IDA ...
2
votes
2answers
2k views

Does IDA support remote debugging in their Freeware Version?

I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...