Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,928
questions
1
vote
0
answers
12
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
-1
votes
0
answers
207
views
What does this lowlevel function do?
I am currently reversing a game called Warframe and have gotten quite far.
There is just one function which is really making me wanna give up.
One hint I can give: The function was found IN another ...
- 1
0
votes
1
answer
119
views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
CommunityBot
- 1
0
votes
0
answers
18
views
Restore debug symbol for a embedded .bin image with an .axf file
I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device.
The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
- 3
1
vote
1
answer
37
views
How to define an xmmword variable in IDA?
How to define an xmmword variable in IDA?
IDA identified one variable as xmmword but I can't find a menu to define other variables around it as xmmwords:
I also tried to set the type after pressing ...
- 206
-1
votes
0
answers
23
views
ida pro overwrite bytes not increase rom location (Value)
I am using IDA pro and try to edit hex code but when try to edit then it's overwrite the hex code not adding new code. In my IDA pro edit patch already enable but still overwrite and old hex code ...
4
votes
4
answers
2k
views
IDA: Generic approach to determine if an instruction reads from, or writes to, memory?
I would like to determine if an instruction a) reads from or b) writes to a memory address.
I can currently think of two approaches in IDA:
Looking for a list of mnemonics (better: particular opcodes?...
- 1,469
1
vote
1
answer
37
views
IDA Pro S12X flash page references
Trying to analyse a dump from MC9S12X series MCU and can`t get how IDA making cross flash page references and if it could be done without scripts.
The project contains 64 code segments with linear ...
- 11
0
votes
0
answers
20
views
How can IDA Pro disassemble paged memory from HCS12 processort?
I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory?
If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
- 11
1
vote
0
answers
26
views
In IDA is there a way to load the PE headers after the initial loading?
This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it.
But suppose I have already worked on an IDB for a while and realize that ...
- 10.5k
1
vote
1
answer
3k
views
When analysing a PE (.exe) in IDA Pro how can I jump to the 'user code' section and skip all the header/libary code?
Suppose I'm disassembling helloworld.exe (a program that outputs the string "hello world") and want to see the user code or code section for the file in IDA Pro.
In what address would the ...
- 10.5k
1
vote
1
answer
87
views
In IDA, what does the number of underscores prefixing a function name mean?
In IDA, in the Functions subview, many functions have one or more underscores in their name. I'm guessing the number of underscores implies something. Does anyone know what the number of underscores ...
- 10.5k
4
votes
3
answers
3k
views
How to use IDC to clear output window in IDA Pro?
As a beginner I'm trying to use IDC to clear output window in IDA Pro,but I don't know which function will work.
My IDA Pro version is 6.1.
- 1
1
vote
1
answer
54
views
Ida cannot open. a files of esp32 (Xtensa)
I tried to open this file with IDA Pro
https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a
Ida detect that is ELF for Xtensa (relocatable)
But when I tired to open it I got
Undefined ...
CommunityBot
- 1
2
votes
1
answer
342
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
CommunityBot
- 1
1
vote
0
answers
25
views
Warning: struct->til conversion failed
In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code.
So I created a struct from the selection (Create struct from ...
- 10.5k
1
vote
1
answer
94
views
x86 - How do I detect virtualized code by looking at the assembly?
How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
- 7,799
1
vote
1
answer
260
views
Guidelines for dealing with obfuscated code
I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
- 101
1
vote
1
answer
76
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
- 7,799
0
votes
2
answers
51
views
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
In IDA, I have the following disassembly code (from an old 16-bit DOS application) :
les bx, _Foo
mov word ptr es:[bx+84h], 0FFFFh
mov word ptr es:[bx+8Ch], 0FFFFh
mov word ptr es:[bx+...
- 34.6k
1
vote
1
answer
53
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
- 7,799
1
vote
2
answers
186
views
IDA 7.5 Show the Progress from Auto Analysis?
Is it possible to create a box / bar in IDA wich indicates the progress?
- 121
0
votes
1
answer
23
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 34.6k
0
votes
1
answer
22
views
Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?
As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
- 1,091
1
vote
1
answer
29
views
How to rename the text of grouped nodes after creating them in IDA?
After I group nodes in IDA in the Graph View and name them, I can't change the name. I tried Edit group text button:
And Rename button:
I also tried anterior, posterior, normal comment and ...
- 76
0
votes
0
answers
58
views
reversed DOS game uncompression code: is that maybe a known compression method (RLE,...) or self-invented?
crossposted from stackoverflow - but i think stackexchange is better suited for such questions
History:
im currently working on reversing the game loader of the 1990 DOS game Alpha Waves
Youtube
i've ...
- 251
1
vote
0
answers
26
views
Why Qiling doesn't recognize the right EntryPoint?
I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point.
Here is the Entry-Point in IDA and in ...
- 83
1
vote
1
answer
40
views
Does COT_HELPER have arguments/operands?
I am trying to learn the hexrays ctree api. I am using the python bindings.
The task I am trying to automate is tracing the arguments to wrmsr instructions.
I notice that hexrays represents them like ...
CommunityBot
- 1
0
votes
0
answers
28
views
how open .dmp file x64 in ida pro
how open dump file (proccess x64) in ida pro?
ida.cfg
DBGTOOLS = "C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\";
DBGTOOLS = "C:\Windows\System32\"
- 21
0
votes
1
answer
61
views
Decompilers points to non-existing virtual function
As part of solving the Hidden password challenge, I found an condition calls a virtual function
the v14 points to v8 variable :
and the functions in the program does not make sense for me, there is ...
- 2,300
0
votes
1
answer
53
views
Z3 is unable to predict the operand
When I try to solve this crackme chall (https://crackmes.one/crackme/61ffb07c33c5d46c8bcbfc1d) , there is a condition that I can't bypass and my z3 script can't predict the input string that will ...
- 2,300
0
votes
1
answer
37
views
How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?
TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc).
In order to explicitly load a type library I can use ...
- 10.5k
1
vote
1
answer
239
views
Breakpoint on memory access in ARM debugging
I'm using IDA Pro for ARM native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware breakpoint is not possible. How can I do? ...
- 10.5k
1
vote
2
answers
76
views
IDA Free: How to patch a memory address
I have a disassembly line showing:
lea rcx, Format
In which Format is a memory address named by IDA. The address is at 0x1400132E0 and points to a C-String "hello, my dear\n".
What I want ...
- 10.5k
1
vote
2
answers
2k
views
Adding automatically standard structs or enums
Is there any kind of IDAPython/IDC function, i.e. a programmatic method, that allows you to simulate this?
Structures -> Insert -> Add standard structure
- 10.5k
1
vote
1
answer
92
views
How to force IDA to analyze a function immediately? [duplicate]
I think my question is probably related to this one:
API to force reanalyze of function (Alt-P)
When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
- 2,300
3
votes
1
answer
595
views
API to force reanalyze of function (Alt-P)
Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml)
Is there a way to do this through API?
- 10.5k
1
vote
1
answer
281
views
IDA - How do I find every call to a sub
I'm using IDA to try and understand how a particular executable works. I've found the routine I'm interested in IDA Pro and it all makes perfect sense, in so much as I can see exactly the process play ...
- 281
0
votes
1
answer
560
views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
CommunityBot
- 1
0
votes
1
answer
43
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 10.5k
0
votes
0
answers
32
views
Is it possible to copy a video game and edit the copied version?
Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
6
votes
1
answer
2k
views
IDA Pro 6.4 android_server processattach failed
I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
CommunityBot
- 1
0
votes
0
answers
22
views
Better debug output with IDA
I don't have much knowledge and experience with assembly so I value more or less readable IDA's pseudocode output. I want to examine stack and locals of the specific functions I set breakpoint in, ...
- 33
0
votes
1
answer
76
views
idapython: how to get decompiler output corresponding to the indirect call
For, e.g. disassembler or IDA view:
Decompiler or Hex View:
I can get the decompilation of whole function using something like:
decompiled = ida_hexrays.decompile(ea)
But, in this way I get the ...
- 156
0
votes
1
answer
122
views
1
vote
1
answer
56
views
IDA pro and compiler-optimized 1-based array accesses in structure
I know title isn't very clear so here is an example of a code I'm trying to disassemble:
struct Inner {
int field1;
int field2;
};
struct Outer {
int some_data[16];
struct Inner the_array[16];
...
- 156
0
votes
1
answer
58
views
Best way to monitor the access to a DLL of a software?
I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module.
Now I'm trying to find out how ...
- 228
2
votes
2
answers
367
views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
CommunityBot
- 1
1
vote
1
answer
125
views
Is there any way to apply FLIRT signatures through a script like idapython?
I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
- 3,179
0
votes
1
answer
66
views
Appcall on function that uses global variables
I'm reversing an executable, there is a function in the executable that uses global variables that are not used in any other function, they are initiated in the target function, My question is will ...
CommunityBot
- 1