Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,520
questions
3
votes
1answer
152 views
how to calculate max possible stack size utilization
Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython?
currently my best approach is iterating through all functions and counting stack-...
0
votes
1answer
24 views
Link to function with IdaPython
In my IdaPython script I print function that I found.
print(func_address)
How can I do that if user click on this function (in output windows) Ida will jump to this function?
1
vote
1answer
31 views
Names not populating from disassembly to decompiler
I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation.
I have never noticed this ...
5
votes
1answer
2k views
How to simplify C++ standard template library in IDA?
I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names sub_xxyz changes to std::xyz, which is as expected. But there are many ...
0
votes
0answers
5 views
How to give multiple inputs to IDA when using remote linux debugger every time the program is restarted?
So this is a problem I'm facing when solving pwn CTF challenges
i usually need to give many inputs for a program to reach certain point every time i restart it
i tried to do it like this, by putting ...
0
votes
0answers
10 views
Hex Rays Mapping To Wrong Variable
The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
0
votes
0answers
53 views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
0answers
48 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
0
votes
0answers
15 views
syscall without saving values in the correct registers
I'm RE a challange of pwnable.tw (dobblesort) and I found some strange things while disassembling the file.
My Question is about the syscalls that are done.
Why they don't save the value in the ...
0
votes
0answers
5 views
compile gdb with python 3 for gef-ida-interact
I'm trying to use GEF's IDA-interact which has issues with python2.
I'm using android-ndk-r20b/prebuilt/linux-x86_64/bin/gdb - v7.11 using Python engine 2.7
How do I compile gdb with python 3.x ?
I ...
1
vote
1answer
27 views
How to find the new address of a function on a new version of the same assembly with IDA?
Well, I have the old version of an assembly with a mapped address to a function I need to detour.
The developer has stopped the reverse engineering to that assembly, so now, I want to do his job. But ...
0
votes
1answer
3k views
Decrypting Lua Files
I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted.
...
0
votes
0answers
12 views
Disassembly Memory Organization parameters for C166 micro firmware (RAM and ROM section)?
I'm trying to disassemble some microprocessor firmware with C166 architecture in IDA, but I have no idea what to use for the memory organization screen (IGNORE THE VALUES IN ROM/LOADING SIZE)
My ...
0
votes
1answer
30 views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
1
vote
0answers
40 views
Using Python 3.7 and 2.x in same IDA
I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.
Is there any way to run that Python 2.7 based plugin?
0
votes
0answers
12 views
Using Gdb-Server with Ida 7.4 failed
I have gdb-server to arm , downloded from https://github.com/therealsaumil/static-arm-bins/blob/master/gdbserver-armel-static-8.0.1.
When I use Ida 6.6 to connect remotly to this gdb-server that work ...
0
votes
1answer
294 views
Calling imported DLL functions from an injected DLL?
If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions?
I'm able to find the ...
0
votes
1answer
216 views
IDA change string in rdata
This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php?
toquizwammer.github.io
Thanks.
0
votes
1answer
53 views
How can I find the real function that *(_DWORD *)v2 + 24) point to?
How can I find the real function that *(_DWORD *)v2 + 24) point to?
(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);
int __fastcall sub_1(int a1, int a2)
{
int v2; // r4@1
int ...
0
votes
0answers
29 views
IDA plugin handles signal only on hotkey press
IDA plugin handles signal only when I click the "hotkey" and not when I execute signal with
$ echo "test" > /tmp/fifo & # created w/ `mkfifo /tmp/fifo`
$ kill -SUIGUSR2 $(pidof ida)
Plugin ...
2
votes
1answer
50 views
The questions about li instruction
When reversing a MIPS binary using IDA Pro, I have 2 questions.
The source code is as follows.
int main(int argc, char* argv[])
{
int m = 1;
int n = 5;
printf("sum = %d\n", m+n);
}
....
0
votes
1answer
34 views
Get input with IdaPython
How can I get input from user with IdaPython?
When I tried str = input() ,I got error RuntimeError: input(): lost.sys.stdin
0
votes
1answer
35 views
Reference address by name in Radare2/Cutter
I have some experience with IDA and now I'm trying to use Radare2/Cutter the same way. I disassemble a DOS MZ file. I have the following:
;-- section.seg_000:
12: entry0 ();
0000:0000 push ds ...
0
votes
0answers
12 views
Open all object files in Ida
I have archive file , like libc.a .
When I tried to open it with ida, ida ask to choose one object file that contain in archive file.
Is there any way to open all the object files in one Ida project?...
0
votes
1answer
148 views
IDA taking forever to run autoanalysis on remote Android app?
I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
0
votes
1answer
28 views
How to get the current offset use IDC or IDAPython?
When writing an IDA script, how to use IDC or IDAPython to get the file offset for a memory address?
0
votes
0answers
39 views
What does the file pointer of fgets actually point to in linux?
So i was reversing a 64 bit ELF binary, and it did a call to fgets, and based on documentation the third argument of fgets is a file pointer.
now the weird part was that the third argument in this ...
0
votes
0answers
27 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
1
vote
1answer
150 views
Extracting instruction and operand information in IDA Python
I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
2answers
46 views
Gui disabled program functionality
Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.
Right now there's one button remaining labeled "Encrypt", which is greyed ...
0
votes
0answers
34 views
Find common functions in arm static binary
According to Detecting libc function with IDA
I have static binary for arm and I want to find common function like fread sleep printf ioctl etc.
When I looking for string in this binary I found glibc ...
0
votes
1answer
41 views
is there any way to get type information using IDA Demo
I am using IDA Demo (evaluation version >7). I have a binary:
#include <stdbool.h>
int do_decode(){}
int main()
{
bool decode = false;
char opt = getopt();
switch (opt)
{
case 'd':
...
1
vote
1answer
59 views
Unable to intercept traffic of an android app even after patching ssl pinning
Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
0
votes
0answers
38 views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
0answers
31 views
IDA Pro - Binary data xxx is incorrect, maximum possible value is xxx
I'm analysing a shared object (.so) file from an Android app. When I try to disassemble it on IDA Pro, it gives me errors
Binary data xxx is incorrect, maximum possible value is xxx. Do you want to ...
0
votes
1answer
13 views
Appcall on function that uses global variables
I'm reversing an executable, there is a function in the executable that uses global variables that are not used in any other function, they are initiated in the target function, My question is will ...
2
votes
2answers
2k views
IDA Pro: Where does newly created structure go to from Pseudocode window?
Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing "Create new struct type".
I don't see new ...
0
votes
1answer
23 views
In IDA's strings window, how to run MakeStrLit on all the selection
Ida allows to turn bytes into a string using the A shortcut
There is also this window to find strings :
You can press enter to jump to a specific string, but is it possible to run MakeStrLit on all ...
15
votes
3answers
3k views
What are nullsub_ functions in IDA?
In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction).
So, what are those and why are ...
0
votes
1answer
80 views
Does IDA Pro's Freeware version have a command line interface?
Does anybody know if IDA's FreeWare version 7.0 has the Command Line Interface option?
I currently have IDA FreeWare 7.0 and I only see one .exe file which is ida64.exe. But according to HexRay's ...
0
votes
0answers
63 views
CHBByteStream operator<<, get only one argument - value
Anyone heard about CHBByteStream? It's from Harman headunit (car radio). I don't know how it's passing arguments. SWID is 4 bytes, VIN is 17 bytes, it should be connected in some way, to pass thru ...
0
votes
1answer
138 views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
33 views
Is it possible to dump input file?
Similarly to retrieve_input_file_md5, I was looking for a way to dump a patched input file.
Basically, I would like to do the following:
patch the file in IDA
dump the patched input file to another ...
0
votes
0answers
44 views
Detouring function cause exception access violation
i am learning to detouring functions, but i run into one that i cannot be resolved.
I use the Detour lib from microsoft, and a custom method.
Both cause the same problem, the function is hooked and ...
0
votes
1answer
46 views
IDA subroutine code running when not being called
Im trying to find where this subroutine is being called in IDA. I use xrefs to see where the subroutine is being called and I NOP the all the calls in all the subroutines in the xrefs. I do this for ...
0
votes
1answer
72 views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
0
votes
2answers
1k views
Resource Hacker and IDA PRO
How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH).
e.g. I find, in RH the following Menu items:
POPUP "Painter"
{
MENUITEM "Start/Continue", 32840
...
0
votes
0answers
31 views
Loading garmin Foretrex 601 firmware into IDA Pro
I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin)
But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch.
The GCD file can be ...
0
votes
0answers
51 views
Lua script decode method?
I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script ...
1
vote
2answers
59 views
NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?
I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
