Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

8
votes
0answers
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
6
votes
0answers
532 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
6
votes
0answers
747 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
6
votes
0answers
333 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
5
votes
0answers
159 views

What is the pictured x86 technique/area called?

I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
4
votes
0answers
239 views

IDAPRO from command line interface: Exporting IDB file to BINEXPORT file

I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: "<path-to-idaq.exe>" -A -OExporterModule:<result-...
4
votes
0answers
496 views

Obtaining the decryption keys for Super Mario Run (Android/iOS Game)

Super Mario Run is a il2cpp Unity game. Most of its assets are downloaded in-game through http requests. I particularly want the OGG files of the music. I can see the list of their names comes from ...
4
votes
0answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
3
votes
0answers
131 views

IDA Pro's debugging - Stack view , Register values and ASCII decoding

Below questions are related to IDA Pro debugging: 1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
3
votes
0answers
105 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
3
votes
0answers
445 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
3
votes
0answers
191 views

IDA does not follow relative jump, executable patching

I created small C program (x86) with this asm code inside main: __asm { jmp label // EB 02 nop // 90 nop // 90 } label: Loaded it in IDA (in static mode, so ...
3
votes
0answers
214 views

What does this enum mean (IDA Pro)?

Trying to teach myself how to use IDA Pro, and I'm stuck trying to understand this enum: enum Input::Action, copyof_42, bitfield Local type 42 is defined as: typedef ChunkStatus::Enum who's enum ...
3
votes
0answers
1k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
3
votes
0answers
85 views

Catch function flags change event in IDA plugin

Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it ...
3
votes
0answers
1k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
3
votes
0answers
1k views

Load multiple modules in one IDA database

I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
3
votes
0answers
252 views

IDA: How to automatically resolve references to Imports in modules loaded manually?

every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
3
votes
0answers
316 views

Sharing IDC file between versions 5 and 6 of IDA pro

I am using version 6 of IDA because it is the only one that works on Mac. My colleague is using IDA 5. We would like to collaborate by sending the an IDC file back and forth. However, the IDC file ...
3
votes
0answers
313 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
3
votes
0answers
417 views

Where is uni.inc file?

In the IDA Pro generated asm code, I see this line: include uni.inc ; see unicode subdir of ida for info on unicode I don't find unicode subdir nor do I find uni.inc file... Could any one give me ...
3
votes
0answers
288 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
2
votes
0answers
145 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
2
votes
0answers
67 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
2
votes
0answers
106 views

Show parameters stored in stack with __fastcall in IDA

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention. mov [rsp+32], rdx ...
2
votes
0answers
118 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
2
votes
0answers
123 views

replicate external bank switching in IDA Pro

I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
2
votes
0answers
140 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
2
votes
0answers
184 views

How do I read over an undefined function with IDAPython?

I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined ...
2
votes
0answers
54 views

IDA : trap call

i'd like to improve support for Atari ST in IDA. To do this, I'd like to know if there is a way to handle trap #1 (gemDos), trap #2 (gem), trap #13 (bios) and trap #14 (xbios) used this way MOVE.W #...
2
votes
0answers
1k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
2
votes
0answers
128 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
2
votes
0answers
729 views

IDA Pro GDB QEMU Tricore setup

I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2): https://www.hex-rays.com/products/ida/support/...
2
votes
0answers
299 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
2
votes
0answers
475 views

How to patch object file in static library / how to extract object file that has full path within archive

I am trying to extract an object file (.obj) from a Windows static (.lib) library so I can patch it in IDA, then rearchive it back into the library. I am doing this because IDA won't allow me to ...
2
votes
0answers
90 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
2
votes
0answers
150 views

Is there anyway to save search results in IDA Pro?

This might be a newbie question but it really takes too long to search for certain things in IDA, when I close the app and save the database all my searches are gone and that's just frustrating. I'm ...
2
votes
0answers
1k views

IDA LoadLibraryError

I installed IDA Demo today, however I'm having a bit of trouble installing plugins. I'm trying to install a plugin called 'ClassInformer'. I followed all the instructions, editing the plugins.cfg file,...
2
votes
0answers
295 views

How to propagate an enum type in IDA Pro?

I'd like to mark some data as being an enum, and have that automatically propagate to all uses of this piece of data. Both direct accesses to the data (e.g. cmp data_with_enum_type, enum_value), and ...
2
votes
0answers
606 views

IDA Pro get line number in main view

I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
2
votes
0answers
2k views

Can IDA generate C code for ASM assembly wihtout the binary

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
2
votes
0answers
674 views

IDA Pro user-defined offsets (again)

I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset. I have a line of code as: ld de, #0x6058 and FTR, this address ...
2
votes
0answers
930 views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...
2
votes
0answers
1k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
2
votes
0answers
772 views

Attach to specific process using IDA + WINDBG in kernel debugging

I asked this question at the StackOverflow website and they referenced me here. (Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
2
votes
0answers
610 views

Search hex dump in IDA pro remote debugger

I am using IDA Pro to debug an ELF binary remotely. While debugging, I want to search for a specific address in the hex dump. In Olly debugger, we have the option to follow any address or register in ...
2
votes
0answers
187 views

Getting basic blocks using SDK

How to map an arbitrary address to its corresponding basic block in IDA? There are several ways to do it using Ida-python, but I am interested in pure C++ solutions (using IDA SDK, of course).
2
votes
0answers
4k views

Fixing the stackpointer in IDA when exception handlers are used

The code that I'm looking at uses exception handlers and it seems that the stack pointer is misscalculated in the case of the exception handler. I posted this function as an exmple in full, so that ...
2
votes
0answers
2k views

IDA pro and Bochs Debugger

I am debugging a shellcode in IDA Pro IDA Pro version: 6.1.011 (32-bit) Bochs version: 2.6.2 I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want ...
1
vote
0answers
23 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...