Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,630
questions
9
votes
2answers
2k views
Importing list of functions and addresses into WinDbg
When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in).
Since I prefer my kernel debugging with plain ...
0
votes
0answers
20 views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
2
votes
1answer
81 views
Can I use python3 with IDA 7.0?
Got IDA Pro 7.0 (I can't update at the moment),
I'm currently unable to use idapython.
I have python3.8 installed on my machine and nothing else (I dont want any collisions).
How can I use make ...
1
vote
1answer
184 views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
0answers
16 views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
now there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
-1
votes
1answer
79 views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
-3
votes
1answer
121 views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
0
votes
0answers
21 views
Failed to load .net binary on IDA Pro
I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file:
but when I click OK to load the program, the following error occured, and the program can't be loaded:
I tried to google ...
0
votes
1answer
22 views
Can't find sequence of bytes in IDA while debugging
While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44:
I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
2
votes
2answers
619 views
How to help IDA to auto complete libc functions?
I have a x86_64 ELF binary which is statically compiled. With some digging,
I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code
shows sycalls as inline assembly code. But in ...
2
votes
2answers
1k views
IDA Pro: How to set data size and data length in “Watch List”
When using Watch List(Debugger->Watches->Add watch) in IDA Pro, I want to add a memory scope(data size(db) , data length(18)) into Watch List.
However, IDA always only add a dword byte(data size(dd) ,...
-1
votes
1answer
44 views
IDA decompile binary file
how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
0
votes
0answers
41 views
How to reverse engineer structs
I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
0answers
14 views
IDA, wrong jmp operand after patching
I'm writing a python script for IDA to automate the deobfuscation of a binary.
After patching with a jmp instruction ida provides the following disassembly:
.text:008FD01E jmp ...
1
vote
1answer
49 views
Get a networkx graph from the the function call-graph of the file using IDApython?
Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
1
vote
1answer
165 views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
0
votes
1answer
38 views
Packer changed memory in IDA?
I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it,...
0
votes
1answer
56 views
What is the meaning of ARM LDAXR/STLXR instructions?
Often while disassembling ARM files, I see some code snippet with the following pattern:
loc_BB30:
.text:C0 FE 5F 88 LDAXR WZR, W0, [X22]
.text:00 04 00 51 SUB W0, W0, #1
.text:...
0
votes
0answers
21 views
in ida pro 7+, what is the way to get a list of applied functions by signature?
I can only see the number of applied functions, but not the full list.
In the function window, there is no way to differentiate which signature lib is applied
0
votes
1answer
66 views
IDA hex != String
, Hello. to learn reverse engineering, I would like to simply change a string via IDA.
I select my string, get the adress, and select Change Bytes to get the Hex value :
After That, I try to convert ...
0
votes
0answers
22 views
IDA - tracing strings
Is it possible for IDA to save string/memory content pointed by one of the registers during run-time?
2
votes
1answer
45 views
Structure of operand bytes in .NET call and data access IL instructions?
I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions
for example based on experience, the last byte of API/...
2
votes
2answers
618 views
Is it possible to completely reset a cached graph layout for a function in IDA Pro?
I'm reversing a binary dump of an older embedded target using IDA Pro 7.0.
Now I have somehow managed to introduce a "pseudo graph node" that I for the love of god cannot make go away.
The ...
0
votes
1answer
30 views
Get current file name with IDApython
I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.
the closest things ...
3
votes
1answer
190 views
how to calculate max possible stack size utilization
Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython?
currently my best approach is iterating through all functions and counting stack-...
-1
votes
1answer
61 views
What does xchg means when accessing array element?
I have ASM code of some Windows *.exe in IDA:
mov rax, [rbx+10h]
mov ecx, edx
xor edx, edx
xchg rdx, [rax+rcx*8]
Which is decompiled to pseudocode to
_RAX = this->m_someMemoryPool;
...
0
votes
0answers
23 views
C166 Memory and Addressing mode
Here I think I have some wrong in base concepts,
In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5.
So, we ...
1
vote
1answer
171 views
Bp on memory access in arm deb
I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
2
votes
2answers
383 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
0
votes
0answers
21 views
How does Andriod .so files Reverse Engineering with a dissasembler like IDA pro and Cutter work
So few days ago going through youtube Reverse Engineering videos, i came across a particular video where an android application was modified using IDA pro by disassembling it's .so file found in /lib ...
2
votes
1answer
269 views
Decrypting some possibly XXTEA encrypted lua/game files
I am trying to extract assets from a Chinese game, I downloaded the apk file and unzipped it. I looked through the files and they are encrypted in some ways, the PNGs and LUAs are unviewable.
The ...
0
votes
1answer
587 views
Decrypting Lua Files from game
I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki).
Links to files of game:
libhellolua.so (cocos2dx external library)
example encrypted LUA-scripts (*.abc files)
I was reading a ...
0
votes
0answers
27 views
Doubts about a pointer in a DLL
I am working with the dll of a software in which I am not with access at the moment, analyzing the source code in static analysis tools, I realized that it receives a pointer as one of the parameters, ...
0
votes
1answer
135 views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
0
votes
2answers
364 views
IDA PRO - compare running process
I have a software which writes some data to specific location in memory depending on user choices.
Say i can have 2 choices, A & B.
I want to run IDA, set option A and save all the data, then run ...
0
votes
1answer
54 views
Cant recognise where is my targeted function executed
Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here:
if (...
-1
votes
1answer
981 views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
0
votes
1answer
155 views
Finding function at offset loaded with ADRP/ADD
I have this assembly:
ADRP X8, #off_FFFFFFF006F1E960@PAGE
ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF
LDR X0, [X8] ; qword_FFFFFFF0077F08A8
LDR X8, [X0]
...
0
votes
1answer
433 views
Calling imported DLL functions from an injected DLL?
If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions?
I'm able to find the ...
0
votes
0answers
27 views
Checking if a call is a API/Library call in IDApython?
I asked the question a while ago but found no answer so I'm trying my luck again
the only solution is this :
Finding all API calls in a function
but it doesn't work when the library call is a .NET ...
0
votes
1answer
54 views
What is the use of moving a variable 3 times only to pass it back to the original register, with no calculations in between?
I'm reverse engineering a C++ binary using IDA, and there's one function that I don't quite understand.
x = dword ptr -8
var_4 = dword ptr -4
push rbp
movss rbp, rsp
sub rsp, 10h
movss [...
0
votes
0answers
13 views
How to get the color of a operand in IDApython?
Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
0answers
73 views
C166/C167 code analyzing
Recently I try to reverse piece of assembly code that written for C166/C167 Arch.
But I have a problem with some places for convert to C code, such as:
loc_1892:
mov r9, #4
add r9, r0
mov ...
1
vote
1answer
3k views
idapython: getting a list of all segments
If I open the Segments subview in IDA, I can get a list of all of the segments.
I would like to access this list so I can enumerate through all of the segments.
How can I do this with idapython?
5
votes
1answer
2k views
IDA Pro 6.4 android_server processattach failed
I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
0
votes
0answers
15 views
Get the string usage sequence in each function with Idapython?
The only function i know for this task is idautils.Strings()
but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...
1
vote
1answer
257 views
Finding out ARC file entry point
I got dump from ci module and after deflate compressed data, this time I can't find the data I am looking for without disassembly it, sometimes I can extract data manually, but this time file is a bit ...
1
vote
1answer
110 views
How can I find the real function that *(_DWORD *)v2 + 24) point to?
How can I find the real function that *(_DWORD *)v2 + 24) point to?
(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);
int __fastcall sub_1(int a1, int a2)
{
int v2; // r4@1
int ...
2
votes
1answer
165 views
MakeArray from stack variables using idapython
I want to MakeArray() to stack variables which can be done with IDA like so:
MakeArray() Create an array.
ea - linear address
nitems - size of array in items
This ...
0
votes
1answer
336 views
Disassembling Hexagon - Corrupted ELF
I downloaded and unpacked the modem from Google source, after that
I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says:
"Binary ...
