Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,596
questions
0
votes
1answer
20 views
How to run another IDA script using IDApython?
I'm using IDA batch scripting to run a script on a dataset of malware
the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
8
votes
2answers
2k views
C-sky CPU reverse-engineering
I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think).
I am stuck in the following points :
I am not able to properly identify the CPU ...
0
votes
0answers
40 views
Can I reverse engineer a DLL file and add SEH or some error handing codes to it?
I am using some DLL files in my Java application using JNI library.
The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
0
votes
1answer
48 views
IDA exported header full of errors
Im a noob when it comes to using reverse engineering tooling.
I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are ...
3
votes
0answers
163 views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
0
votes
1answer
30 views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
0
votes
1answer
475 views
How to patch file by adding a branch instruction to another address in arm
I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another.
The original file has:
__text:00017B60 loc_17B60 ; ...
1
vote
1answer
50 views
Why does IDA Pro fail to add these constants?
I am trying to port Enrique Nissim's script from his presentation "Reverse Engineering and Bug Hunting on KMDF Drivers" to IDA 7.4. His original script can be found at:
https://github.com/...
-3
votes
0answers
48 views
Need help to extract xxtea key [closed]
I try to use ida pro to extract xxtea key from a lib.so
Regards
xxtea_decrypt(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)
{
longlong lVar1;
ulonglong uVar2;
...
2
votes
1answer
40 views
Two copies to store values
I have this a piece of code, disassembled DX:
.text:004386D3 push ecx
.text:004386D4 fld1
.text:004386D6 fstp [esp+26Ch+var_26C] ;load 1.0 value ...
0
votes
0answers
172 views
Extracting information from a random cipher or a binary file
I have measured data comes from a various types of sensors. After measurement, the data encrypted and stored in a memory. We monitor the serial data(via:RS232 from the memory), and the data was ...
1
vote
1answer
40 views
What is the easiest way to dump a REGION of memory in IDA pro?
I'm facing a problem that i need to dump a large region of memory with IDA pro
using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for ...
2
votes
2answers
549 views
Is there a way to tell the IDA debugger to apply all patches from the database?
I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all ...
2
votes
1answer
36 views
Register edx and CreateDevice function DX
I disassemble CreateDevice function from my DirectX code and commented each paratemer:
.text:0043F485 mov eax, [ebp+lpParam]
.text:0043F488 add eax, 730h
.text:...
1
vote
1answer
97 views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1
vote
0answers
43 views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
0
votes
0answers
34 views
IDA Freeware Debugger crash on attaching
I run a binary that I am trying to reverse engineer from terminal and when I try to attach it with IDA debugger it says "OOPS! Internal error 20099" occurred.
I am able to load the binary ...
-3
votes
0answers
30 views
How to extract xxtea key from this code [closed]
I try to use ida pro to extract xxtea key from a lib.so
Regards
xxtea_decrypt(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4) {
longlong lVar1;
ulonglong uVar2;
...
2
votes
2answers
40 views
How to call to function while debug
When I debugging remote process with gdb-server and Ida, and put breakpoint in the code, when the process stopped at this breakpoint how can I call to function and after that return to my code ?
1
vote
0answers
30 views
Is there any way to apply FLIRT signatures through a script like idapython?
I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
0
votes
1answer
32 views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
0
votes
1answer
32 views
How can I find the function that throws an error message in IDA Pro? [closed]
Let's suppose I want to use IDA Pro to debug a Windows PE64 application that always throws an error message at a specific point when being run. What steps would I have to take to find the specific ...
0
votes
1answer
673 views
finding file I/O in IDA Pro (actually IDA free)
Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff.
The parts of the program I am interested in is where it reads a file. This is a ...
2
votes
1answer
55 views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
1
vote
2answers
47 views
Defining operand as offset
I have an idapython script which automatically defines bytes as code by a predefined configuration.
The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
1
vote
0answers
83 views
which has better pseudocode? IDA or Ghidra [closed]
I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
35 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
1answer
41 views
Click-thru a virtual function in IDA
I'm reversing some stuff that has RTTI, so finding vftables is easy.
I have an instance of some class some_object, there is a method being called through its __vftable. The method_4 has a type of ...
1
vote
1answer
154 views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
2
votes
1answer
36 views
How to debugging activeX with Ida
When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.
How can I see this ActiveX code(where ...
1
vote
2answers
2k views
How to add/find parameters to a function declaration in IDA/HexRays?
I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode:
...
1
vote
1answer
42 views
Results of radare2 are not correct
I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows:
r2 = r2pipe.open(binary_file)
r2.cmd('aaa')
funcs = r2.cmdj('aflj')
len(funcs) is 461, but the number of functions got ...
0
votes
1answer
28 views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
-1
votes
2answers
57 views
Is address in program can change
I talking about linux arch.
When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2
When I want use that address to breakpoint (for example with ptrace or ...
1
vote
1answer
66 views
IDA pro not showing function names properly
I am working with a C++ application in IDA and whenever I name a function with a :: or a ~ symbol it shows up in the function window as an underscore which is very hard to read (ex. Class::Function ...
0
votes
1answer
271 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
1answer
145 views
Attach one debugger to a DotNet application, and a second one to a loaded DLL
I'm trying to reverse an application that is using a DLL that i'm interested in.
I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
0
votes
2answers
31 views
How to retrieve name of a variable defined in the data segment in IDA when no process is attached?
I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS).
push word ptr ds:8401h
Since I have ...
1
vote
1answer
31 views
Displaying Operands as Position Independent in IDA
I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format'
lea rdi, format
However, when ...
0
votes
0answers
15 views
How to work on diffing result generated by bindiff
I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython.
*work is like finding no basic blocks, no of edges
0
votes
0answers
39 views
Defeating Tall Call obfuscation or something similar
If you look at the image below, you will see that IDA Pro's static analysis fails because the function doesn't actually end up there. There is no ret, add esp, 0x20 or pop to free the arguments on the ...
0
votes
0answers
24 views
IDA SDK Assemble instruction
What's the method of assembling instructions in IDA SDK c language?
Is that possible by passing insn_t* or str like option available in IDA [Edit->Patch program->Assemble]
2
votes
1answer
50 views
Best way to quickly mark all lines as code in IDA?
I have a fairly large obfuscated program, and I need to mark all of the lines as code. I was able to do this in IDC by iterating through the lines and running MakeCode. It works for small amounts of ...
1
vote
0answers
29 views
How to clear all comments created in ida using funcap?
How to clear the comments created by funcap and restore database to it's previous state?
I tried reanalyzing the program but comments do not seems to go away from database.
Though, checking-off ...
1
vote
1answer
92 views
Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?
I have the following disassembly which looks like a buffer being populated with zeros in a loop, however, I'm confused at why the alignment is needed here (if a jump will always be 4-bytes, why does ...
0
votes
1answer
30 views
IDA No Search Results in Subview For Viable Address
I found an address of a function from the game AssaultCube, and the address is 0045BCA0. In IDA, I disassembled ac_client.exe as a portable executable and tried to search for that address in the ...
0
votes
0answers
22 views
Ida pro 6.5 (BATCH MODE)
I have a question related to IDA pro 6.5 batch mode. I want to disassemble (.exe) files and generate (.asm) files. I have executed the cmd command for this and generated an asm file too. But it does ...
1
vote
1answer
52 views
Variable var_4 filled with value -1
Who can explain to me, why this line code there is before each jmp or end of some part of code where there is label. What this line of code is to do?
mov [ebp+var_4], 0FFFFFFFFh
This is WinMain ...
2
votes
2answers
375 views
Reading stp (Designaknit Stitch Pattern)-Files II
I know this is not an answer "Reading stp (Designaknit Stitch Pattern)-Files)", but i think it is a way to an answer.
I believe I have the right function found (with ida - i call it testStp), but I do ...
0
votes
0answers
23 views
Setting processor specific options in IDA Python loader
I'm writing an IDA loader in Python for a MIPS system that uses offsets from GP to reference data. By manually setting GP in "Processor specific options", xrefs are working. But, I'd like to ...
