Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,718
questions
0
votes
1answer
25 views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
0
votes
0answers
8 views
How to simplify a function “calling itself's reference”
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
2
votes
0answers
35 views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
0
votes
0answers
20 views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
0
votes
1answer
130 views
IDAPython Export All Addresses Called by Specific Call
The following call gets executed many times and jumps to many subroutines.
call [rbp+var_s38]
What do I need to write in the breakline condition to export all the locations it jumps to?
import ...
0
votes
1answer
274 views
IDA Interpreting mov instructions in a unusual way
When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset.
Hex rerpresentation: 8B 40 0A
Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
2
votes
0answers
74 views
How to find “in degree” of chunks divided by ida pro?
I am working on IDA pro. I am splitting an executable in multiple chunks. My purpose is to calculate the possible ways any chunk can be traversed. There might be multiple ways that any particular ...
0
votes
1answer
58 views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
2
votes
1answer
233 views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
4
votes
3answers
6k views
How to get the list of strings within IDA's string window in my script?
I'm trying to write some scripts that do some string searching through the disassembly in IDA. Currently, I loop through all the disassembly, MinEA() to MaxEA() and use idc.FindText() to see if a ...
2
votes
2answers
60 views
BRANCH OCCURS in IDApro
Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below:
As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
4
votes
1answer
105 views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
0
votes
2answers
51 views
Correct target of absolute jmp in IDA
In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution:
F000:FEFF : mmap'ed location of function ...
2
votes
2answers
293 views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
1
vote
1answer
98 views
Hex-Ray Decompiler: inline function not recognized
While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
0
votes
1answer
182 views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
1answer
29 views
Hex Rays Mapping To Wrong Variable
The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
0
votes
1answer
17 views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
3
votes
1answer
96 views
Ghidra + IDA cant detect a string but Radare2 can
Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
0
votes
1answer
37 views
Exporting C++ types from database to another
I have a pe dll binary with it's pdb file. I'd want to use this file's types in another database.
I tried to export the types using "Create C header file" and "Dump typeinfo to IDC file&...
1
vote
1answer
744 views
Is it possible to get back to a compilable form of source code using IDA pro [duplicate]
I am familiar with debuggers and sorts. I was going through a program and noticed that IDA does make some mistakes on what it decides what on its pseudo code will be.
Is there a list of common ...
1
vote
2answers
66 views
Find assembly in binary with ida python
I want to find 2 consecutive instructions with Ida python
move r2,r3 ; move r2 r4
What is the easy way to find the addresses of that with Ida python?
I can Iterate on all Functions and for each ...
0
votes
1answer
48 views
Converting a data address offset to the equivalent struct in a C++ module
I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so:
v32 = ( v3 + ...
3
votes
2answers
358 views
IDA Python get struct type with dependencies
Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
2
votes
1answer
160 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
0
votes
1answer
49 views
Ida python find function address that using string
I have string at address 0xaaaa that I want to know the address of function that use this string
import idautils
len(list(idautils.XrefsTo(0xaaaa,1)))
return 0
Why is that ? When I tried this code ...
1
vote
1answer
204 views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
2
votes
0answers
42 views
Is there a way to resume execution of a process for a given amount of time then suspend it?
I am using the following IDC script in IDA:
#include <idc.idc>
static main()
{
for (i=0; i<10; i++)
{
PauseProcess();
...
0
votes
1answer
26 views
How to avoid database / code mismatch when developing and debugging your own code in IDA?
This seems like a very basic use case and I can't get it to work properly. I'm developing my own test application in Visual Studio c++. I want to test it through several IDA debugging sessions. Every ...
0
votes
1answer
50 views
How use signature pattern for hooking
I like to replace the static function address:
AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer)
using signature pattern:
SigScan ...
5
votes
2answers
4k views
Can IDA Pro automatically deal with VM obfuscated binaries?
VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro.
According to this slides
www.hex-rays.com/products/ida/...
6
votes
3answers
77k views
How to obtain x86-64 pseudocode in IDA Pro?
Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
0
votes
1answer
46 views
Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?
I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
0
votes
2answers
90 views
IDA hex != String
, Hello. to learn reverse engineering, I would like to simply change a string via IDA.
I select my string, get the adress, and select Change Bytes to get the Hex value :
After That, I try to convert ...
0
votes
0answers
26 views
IDA is already trying to suspend the process crash when debugging kernel?
Unlike Windbg where you can easily stop, in IDA when i want to pause the debugee and click on suspend, IDA says "IDA is already trying to suspend the process" then most of the times it ...
0
votes
0answers
23 views
IDA Windows determine programming language used? or even narrow down to compiler
[Python] So basically if something is written in python it basically screams at you "Hey this is python" if you go to a hexview and see tons of 'py' at the start of a module (pySpark, ...
1
vote
1answer
52 views
Using windows 10 for malware analysis
I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
2
votes
4answers
81 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
1
vote
1answer
50 views
IDA - Rename Address/Function: Says name exists already but it does not show up anywhere
I am trying to rename a function address in IDA (free) and it says that the name I picked already exists in the database (Error Code: 8727B0) ... but the provided name does not show in the functions ...
2
votes
1answer
36 views
What is the difference between uintX_n (used in IDA Pro) and unitX_t types?
During debugging a binary in IDA Pro, I've noticed types of the form
30 uint16_n 00000002 struct {uint16_t inner;}
42 uint32_n ...
3
votes
1answer
208 views
how to calculate max possible stack size utilization
Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython?
currently my best approach is iterating through all functions and counting stack-...
6
votes
2answers
2k views
Creating a struct in IDA which contains a cString?
Normally I struct is a fixed size. Is it possible to define a structure which contains an element which has different sizes?
To illustrate what I mean is this.
The layout of the data in the file ...
3
votes
1answer
51 views
IDA Pro “force new variable” for register variable?
IDA Pro 7.2 has a new functionality named force new variable.
See:
Here and Here.
But it is only efficient for stack-based variables. How can I force a new variable for a register-based variables?
2
votes
1answer
33 views
Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
307
votes
16answers
359k views
Is there any disassembler to rival IDA Pro?
Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
1
vote
1answer
50 views
What does this custom piece of frame manipulation code from a router binary do?
I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary:
pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining)
...
2
votes
1answer
185 views
Bp on memory access in arm deb
I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
2
votes
2answers
427 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
0
votes
1answer
767 views
Decrypting Lua Files from game
I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki).
Links to files of game:
libhellolua.so (cocos2dx external library)
example encrypted LUA-scripts (*.abc files)
I was reading a ...
2
votes
1answer
413 views
Decrypting some possibly XXTEA encrypted lua/game files
I am trying to extract assets from a Chinese game, I downloaded the apk file and unzipped it. I looked through the files and they are encrypted in some ways, the PNGs and LUAs are unviewable.
The ...
