Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,762
questions
4
votes
1answer
843 views
Attach Shared Object to android process with IDA
I am:
working with an Android game,
using an Android Emulator,
and trying to attach an android .so library to a process.
I have the whole IDA server set up, I can attach to processes when a classes....
0
votes
0answers
12 views
How do I find missing/undefined functions in IDA64?
I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them?
(*(BaseClient->int640 + 304))(...
2
votes
2answers
376 views
Bochs x86 16bit and IDA dissasembly
I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says "wrong segmentation". Loading in ...
0
votes
1answer
28 views
How to work on diffing result generated by bindiff
I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython.
*work is like finding no basic blocks, no of edges
-1
votes
0answers
18 views
MS-DOS 16 bit Autonet.exe [closed]
I have downloaded Autonet neural network program from https://archive.org/details/msdos_AUTONET_shareware.
This is a a demo program with limitations and there is no full version available. Can ...
2
votes
0answers
14 views
Force IDA to reanalyze a function recursively?
How can i force IDA to re analyze a function recursively (meaning including every function inside of it and so on) and recognize all the functions inside of all the functions? because right now when a ...
1
vote
2answers
194 views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
-2
votes
1answer
1k views
Debug and crack .NET executable PE
i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so
I'm trying to crack an application that is written in C# and all ...
0
votes
2answers
38 views
Import header files in IDA to get the struct definitions?
I am reversing a program that has a lot of internal structs in it.
The problem is that there are a lot of structs, so i can't import them manually using local types->insert.
Lets say i have some ...
0
votes
0answers
19 views
Decompiler view of IDA pro when debugging windows kernel shows the content of every variable as “?”?
When Im debugging windows kernel using IDA pro and i am using the decompiler, it does not show the content of ANY variable, when i hover the mouse to any variable, it just says "?" ??
how to ...
1
vote
0answers
13 views
How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?
Lets say there is a variable x in f1, and f1 calls f2 with the variable x
I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
0
votes
2answers
173 views
Decode xor data in IDA
I have code that looks like this:
byte_100031BA4 = v41;
byte_100031BA5 ^= 0x3Eu;
byte_100031BA6 ^= 0x47u;
LOBYTE(a1) = -9;
byte_100031BA7 ^= 0xF7u;
byte_100031BA8 ^= 0xA9u;
byte_100031BA9 ^= 0xE8u;
...
0
votes
1answer
43 views
Appcall on function that uses global variables
I'm reversing an executable, there is a function in the executable that uses global variables that are not used in any other function, they are initiated in the target function, My question is will ...
-1
votes
0answers
39 views
Export / Convert Ghidra database (GZF) to IDA database (IDB)
I am deeply frustrated after spending the last days searching for a way to do what the title of the question says, but all I could find was IDA database -> Ghidra database conversions.
I have found ...
1
vote
1answer
35 views
Define partial struct with IDA
I want to define struct in Ida , but I know only partial of this struct
I only know that in arr[12] that int student_id , and I don't know the rest of struct. Ida recognize that struct as char * .
How ...
1
vote
1answer
33 views
Is there a way in ida pro to see the address where I have explicitly marked them as code or data, etc?
I'm analyzing an obfuscated binary. IDA did a pretty good job of doing the initial auto-analysis. Later, I went through and marked some sections as undefined, or code, etc. Now IDA can't re-create ...
1
vote
1answer
57 views
Merging a large number of segments in IDA Pro
I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
0
votes
1answer
77 views
What's wrong with my mitm to support rr commands with gdbserver on IDA?
First of here is the gdb remote protocol doc.
The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
1
vote
1answer
741 views
IDA 7.0 (free) fails to load symbols with message “DWARF: Cannot determine location of DWARF info” during debugging
Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM:
Then loaded a test PE file and started debugging it (using Local Windows Debugger):
...
2
votes
2answers
405 views
Can't trace MIPS embedded device remotely
I'm trying to debug a remote device using gdbserver and IDA Pro.
I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
1
vote
3answers
3k views
How to load a color theme correctly in IDAPro?
I work late nights and a dark theme like this would be nice with IDAPro.
I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
0
votes
2answers
386 views
Hex-Rays skips code
have using IDA Pro 6.8 (Hex-Rays 2.2), default settings.
Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
2
votes
3answers
101 views
How can I view the output of printf calls without a console window?
I'm using IDA to poke around in an old video game and noticed there are lots of calls to the printf function:
I can see in another function that dword_5CE914 is a bitmask comprising various startup ...
0
votes
2answers
59 views
Is it possible to “jump” to another address when script detects jmp?
here is the original C++ source code of the executable that I've created to do simple RE
#include <iostream>
void myFunction() {
printf("Hello!");
}
int main()
{
myFunction()...
0
votes
2answers
36 views
Determine if there is a cross reference using idapython given a specific address
I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from)
ea_start = #
ea_end = #
for ea in ...
1
vote
2answers
25 views
How to remove OFF64 SEGDEF from IDA disassembly
This has plagued me from IDA 6.5 to 7.5.
.text:0000000143EFE8CD CC db 0CCh ; Ì OFF64 SEGDEF [_text,140CFC35B]
It may not look like much, but when a conditional jump is placed over ...
0
votes
1answer
217 views
Modifying program using IDA/Hexrays decompilation pseudocode
A bit long-winded, apologies in advance. Updates to the question are at the end.
I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
0
votes
3answers
101 views
Order of arguments in __usercall
i have the following function with five arguments:
; int __cdecl trampolineRegister(void)
a4= dword ptr 8
a5= dword ptr 0Ch
push ebp
mov ebp, esp
add eax, ...
0
votes
0answers
26 views
Can I find out what methods are being swizzled in runtime?
I have an obfuscated dylib injecting into a process in macOS to swizzle objc methods. Obviously I can decompile it to check what it is hooking, but its heavily obfuscated. Hence, can I find out what ...
-1
votes
0answers
23 views
How to use NtDeviceIoControlFile() function to send a keystroke?
I want to use NtDeviceIoControlFile() to send a keystroke but I don't know what arguments to pass.
0
votes
2answers
54 views
Finding function in IDA from x64dbg
I've found a function I want to call in x64dbg, and wanted to see it's prototype and how it looks like in IDA. However, I was expecting to see a function in IDA but land in the middle of one.
The ...
0
votes
1answer
46 views
IDA - How do I find every call to a sub
I'm using IDA to try and understand how a particular executable works. I've found the routine I'm interested in IDA Pro and it all makes perfect sense, in so much as I can see exactly the process play ...
0
votes
2answers
66 views
How to parse the NT headers and section headers of a PE file using IDApython?
I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
0answers
68 views
Where to start analyzing a 16 bit dos program?
I've tried to analyze this small exe online.
I've tried with https://onlinedisassembler.com/odaweb/ (link) but it's hard for me to get the first question:
Why the tool doesn't try to detect the set ...
0
votes
1answer
43 views
how to call the function from IDAPython with passing arguments by manually push them to the stack
would you please tell me how to call the function from IDAPython code ?
I want to simulate it by manually push to stack as the two arguments and calling the function.
0
votes
2answers
40 views
How to get dynamically changing xrefs with IDAPython
There is a situation where the number of xrefs for a function is dynamically increasing due to the dynamic creation of memory with execution rights attached by VirtualAlloc. I want to get the xrefs of ...
0
votes
0answers
26 views
Debugging kernel modul with IDA
I have shell at linux-arm-embedded and running gdb-server, There is kernel module(ko) that I want to debugging .
How can I do that with IDA ?
1
vote
1answer
94 views
How to deal with IDA auto-analysis analyzing invalid paths?
Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis.
There is some mention of ...
0
votes
0answers
19 views
getting the content of the Thread Envoirment Block in IDA Pro
i have started out reverse engineering with IDA Pro a few weeks ago. Currently i am reversing a heavily obfuscated file which uses many anti-reversing techniques and in particular relys heavily on ...
0
votes
0answers
37 views
Editing assembly language to bypass the condition
I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
0
votes
0answers
26 views
how highlight multiple word in ida assembly view? (already know method in graph view, but dont work in text view)
like set different bg or fg for two keyword : eax and ecx (or hex )
not line highlight ....
in graph view , i found a plugin to do this by hook graph node text , but no search result for text mode ...
0
votes
1answer
33 views
How to show the save dialog box with IDAPython?
I want to some strings to the text-file which is chosen from the save dialog box.
Is there any way to show the save dialog box by IDApython and how to write the script code about that ?
0
votes
1answer
62 views
(IDAPython)How to get the function name string from the Function address?
For example, in the Registers windows of IDA pro, It show the following.
( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.)
EAX 766D32B0 WS2_32.dll:...
0
votes
1answer
29 views
Is there any way to STOP the loop of the IDApython?
Is there any way to STOP the loop of the IDApython ?
I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
0
votes
0answers
52 views
IDA help me understand these operations on the memory
I have a stripped binary, which I want to reverse engineer. I spent quite some time with it, and dug myself through most of it, however, I got stuck near these lines.
Context: the program has 5 local ...
0
votes
1answer
167 views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
3
votes
3answers
456 views
Cleaning HexRays Output
My HexRays decompiler output often looks like:
v0 = LoadLibraryW(L"wininet.dll");
v1 = v0;
if ( !v0 )
goto LABEL_1;
v2 = GetProcAddress(v0, "InternetOpenW");
v3 = GetProcAddress(v1, "...
0
votes
0answers
23 views
How to apply complete type information from PDB for multiple images in one IDA database?
IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top ...
0
votes
0answers
21 views
How do I debug Linux kernel modules with IDA?
I'm trying to figure out a workflow for analyzing Linux kernel modules.
I want to debug the modules and not just view the disassembly, so I came upon this guide for IDA pro:
https://www.hex-rays.com/...
0
votes
2answers
57 views
IDA Pro doesnt read updated exe
When I change/update the disassembled exe (like when I rebuild it) then IDA doesn't update the exe.
Thanks in advance,
Best regards,
Adi.
