Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
207
questions
32
votes
5
answers
11k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,475
336
votes
16
answers
418k
views
Is there any disassembler to rival IDA Pro?
Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
- 4,178
37
votes
3
answers
24k
views
What is a FLIRT signature?
I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
- 4,056
10
votes
1
answer
6k
views
Extracting arguments from IDA
Let's say I have the following function in IDA:
int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>)
What's the fastest way to extract the argument information ...
- 2,317
6
votes
2
answers
11k
views
Offset calculation for branch instruction in ARM
As the title says, how to calculate offsets for branch instructions?
For example i have following assembly code,
0x60ECE B loc_60EE6
;
;
;
0x60EE6 LDR.W R2, #0x123
Hex code for location ...
- 165
15
votes
3
answers
11k
views
Which calling convention to use for EAX/EDX in IDA
I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, ...
- 963
12
votes
1
answer
636
views
Are those code snippets and file paths in a C++ binary some sort of standard debug information?
This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info.
Is this something standard? (Is this RTTI)
If so, how is this called?
Are there ...
- 3,059
10
votes
1
answer
2k
views
Mapping an external module's source code to assembly - extracting information from source code
The situation is the following:
I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
- 2,038
9
votes
2
answers
2k
views
Highlight Executed Basic Blocks in IDA
When I execute a program using IDA's debugger interface, I would like to see the basic blocks that were executed highlighted in the IDB. Is there a way to do this?
- 1,527
8
votes
3
answers
637
views
How can I clean up strings built at runtime (stack strings)?
How can I clean up/simplify strings that are built at runtime?
I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
- 83
3
votes
1
answer
5k
views
Finding all API calls in a function
is there a way to get a listing of all called APIs in a function via IDAPython. For example I have the below code from a function.
.text:003A33D9 call esi ; _snwprintf
.text:...
- 1,062
27
votes
6
answers
3k
views
Tools to work cooperatively on the same binary
What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work?
I used various methods long ago to share information with others, but not ...
- 6,684
14
votes
2
answers
25k
views
How do I know the bytes corresponding to an instruction in Hex view in IDA?
When I select an assembly instruction in IDA graph view, I want to see the exact bytes corresponding to the selected instruction when I switch to He view in IDA. How do I do that?
- 1,361
12
votes
2
answers
3k
views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
- 2,038
11
votes
5
answers
12k
views
How to find offsets in OllyDBG from IDA
I'm currently trying to gain some practice in RE and I need some help for patching a DLL.
Here are my steps:
I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
- 121
11
votes
2
answers
5k
views
What to do when IDA cannot provide a function name?
For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
- 215
10
votes
1
answer
1k
views
Information provided by Hex-Rays after @ symbol in variable declarations
Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output:
struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1
int v6; /...
6
votes
2
answers
10k
views
What is the difference between static disassembly and dynamic disassembly?
I am told that tools like IDA Pro are static disassembly tool,
and tools like OllyDbg are dynamic disassembly tool.
But from the using experiences on these tools, I don't think there
is any ...
- 2,475
6
votes
3
answers
4k
views
Segments in IDA. How to overcome NONAME problem
I'm disassembling a packed 16 bit DOS MZ EXE.
To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got ...
- 599
6
votes
1
answer
4k
views
IDA Pro: Is there a command-line way to generate idb files without generating asm files?
Currently, I'm generating a bunch of .idb files in a batch via idaw.exe -B <FILE>. (I'm using IDA Pro 6.8.) This process also creates many .asm files - one for each .idb file created. I don't ...
- 225
3
votes
1
answer
866
views
API to force reanalyze of function (Alt-P)
Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml)
Is there a way to do this through API?
- 135
2
votes
2
answers
4k
views
Why does IDA show wrong function arguments in pseudocode?
I've open a DLL in IDA v7. In one subroutine, there is a PathAllocCombine() function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. ...
- 1,559
2
votes
2
answers
2k
views
IDA pro: jump back to previous instruction
I'm new with IDA pro and currently running with debugger, I have few questions:
How can I jump on previous instruction? Undo the latest instruction ?
Is it possible in IDA to examine memory of an ...
- 129
34
votes
4
answers
16k
views
How to reverse engineer a Windows 10 UWP app?
I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10:
Somehow the results are not the same what is available via ...
- 1,639
23
votes
1
answer
6k
views
Static analysis of C++ binaries
When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
- 1,234
18
votes
3
answers
5k
views
What are nullsub_ functions in IDA?
In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction).
So, what are those and why are ...
- 3,002
16
votes
2
answers
2k
views
Is there an actively maintained collaboration plugin for IDA?
There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)?
These are the tools that I'm aware of, ...
- 179
14
votes
4
answers
7k
views
Creating IDA Pro debugger plugins - API documentation and examples?
Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
- 1,016
14
votes
1
answer
4k
views
Is there an equivalent of 'Run trace' as in OllyDbg for IDA PRO?
I have been looking for the equivalent of the "Run Trace" option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?
- 437
12
votes
5
answers
3k
views
Artifacts similar to "@YAXPAX@" within memory and IDA sessions
When reversing binaries and parsing memory, I often run across strings like "@YAXPAX@" used to reference procedures. Is there a name for this type of convention?
I believe theses strings are symbol ...
- 123
9
votes
1
answer
4k
views
IDA pro and default windows (lib) functions
Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions?
For example, statically linked functions like printf(), memcpy(), memset() ...
- 581
9
votes
1
answer
13k
views
How to find entry point in .exe?
Kind of a simple question. How does a program like IDA locate the entry point of an exe? If I wanted to, could i find this with just a hex editor manually?
- 101
8
votes
2
answers
14k
views
IDA Pro List of Functions with Instruction
I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
- 183
8
votes
1
answer
5k
views
Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better
When I decompile using IDA PRO I get code which could look like both of these
Understanding the __PAIR__ macro.
Macro itself.
// The following definition is not quite correct because it always ...
- 243
7
votes
2
answers
3k
views
How to import Windows DDK headers into IDA?
Currently I'm reversing a Windows driver, and there are a lot of structs IDA doesn't automatically recognize, which means I have to import them manually by parsing C header files.
However, there are ...
- 1,293
6
votes
1
answer
7k
views
Do IDA Python plugins work with IDA free or only IDA pro? [closed]
For example, the plugin fluorescence.py is a very small tool that adds a choice in the "Options" menu of IDA to highlight call instructions. It is supposed to work upon dropping it into the plugins ...
- 61
5
votes
2
answers
1k
views
What is stored in typeinfo (GNU C++, Android NDK, ARM)
IDA annotates some items as: typeinfo for _classname_.
What is that typeinfo, is it the same as type_info?
What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
5
votes
2
answers
5k
views
Can IDA Pro automatically deal with VM obfuscated binaries?
VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro.
According to this slides
www.hex-rays.com/products/ida/...
- 2,475
5
votes
1
answer
932
views
Replacing small length instruction with larger length instruction
Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code.
I am using IDA Pro for analyzing native ...
- 165
4
votes
3
answers
5k
views
Does IDA support remote debugging in their Freeware Version?
I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
- 319
4
votes
2
answers
7k
views
IDA - How to transform VA to FO?
I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a ...
- 411
4
votes
2
answers
4k
views
adding instructions in IDA
I noticed that you can't simply add an instruction in IDA. Yes, you can modify one, but not add(maybe there is such feature? Can't find it though). So I used HxD to forcibly increase the PE binary ...
- 207
4
votes
1
answer
5k
views
How to get the disassembly line without offset translations in IDAPython?
When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.
For example, when raw assembly is:
mov %r15, 0x20b062(%rip)`
GetDisasm()'s ...
- 115
4
votes
2
answers
4k
views
Automating a Decryption function call in IDA Python
I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times.
The function takes three arguments and is a simple xor decryption. However it ...
- 355
3
votes
1
answer
4k
views
What are the unk in IDA pseudo code?
I've open wsl.exe in IDA v7. With Tab key I open pseudocode of sub_1400129F4 like this:
__int64 sub_1400129F4(__int64 a1, __int64 a2, __int64 a3, __int64 a4, ...) {
......
v8 = (__int64 *)...
- 1,559
3
votes
1
answer
13k
views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
- 1,639
3
votes
1
answer
14k
views
how to setup IDA pro linux GDB server
I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
- 335
3
votes
1
answer
4k
views
IDA Pro debugging: follow child process
I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
- 31
3
votes
2
answers
4k
views
Is there a way to adjust local variables when a function doesn't utilize ebp?
I have a problem just like in the question. Modern compilers don't use ebp to handle local variables and arguments, they just calculate and add hard=coded offsets to esp. Example:
sub esp, 5Eh
...
- 163
3
votes
2
answers
27k
views
IDA cannot launch debugger for 64-bit exe files
I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same.
Here is that I do.
Launch IDA Pro (64-bit)
Select Debugger -> Run -> ...
- 819