Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
Ray's user avatar
  • 1,083
0 votes
0 answers
27 views

decode lua files cocos2dx and protected from Frida and IDA64 for hooking

I want to decode the lua and other resources files. But i cant find the key when i use frida or ida 64 it crash before the game start. Game is here https://megamonglobal.com/ https://imgur.com/88Habwu
xbuyk987's user avatar
0 votes
0 answers
53 views

Import function symbols from a reflection system into IDA

I'd like to import structs and functions from a reflection system into IDA. The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
KulaGGin's user avatar
  • 296
0 votes
1 answer
45 views

When parsing a C header file in IDA, is there a preprocessor symbol I can use to detect it?

IDA has the ability to parse C header files (by now a secondary option based on Clang also exists). It is useful to get structs and enums into your database via the Local Types view. Question: Aside ...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
54 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
R4444's user avatar
  • 1,797
0 votes
1 answer
50 views

My ida.reg file got deleted, is there any way to restore ida?

I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed - Is there any way to restore ida? ...
R4444's user avatar
  • 1,797
0 votes
0 answers
44 views

IDA Free Debugger slows down app substantially

I'm using IDA Free to decompile and debug an exectuable (a game, actually). When starting the debugger, the game runs really, really slow occasionally. Before, I have used Cheat Engine to debug the ...
Daniel's user avatar
  • 151
1 vote
0 answers
54 views

How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?

I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
LyZeN77's user avatar
  • 11
2 votes
1 answer
142 views

convert a memory location to string in Ghidra

I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well. I would like to have a decompiled pseudo-code in Ghidra like: ...
Iman Abdollahzadeh's user avatar
0 votes
0 answers
87 views

How to decrypt xxtea encrypt lua file from cocos2D game

I'm trying to decipher this game because it's about to be discontinued I tried to decompile the apk looking for image resources and lua files. Looking at the received title I guess that the game was ...
Neit's user avatar
  • 41
0 votes
1 answer
105 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
Edward Winch's user avatar
1 vote
0 answers
24 views

After loading additional files into an IDA database: can I process it, including applying PDB etc?

After loading an additional binary (.dll) file into an IDA database, is there a way to run it through a similar routine as would happen if the DLL had been loaded standalone? What I am aiming for is ...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
72 views

DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro

I am having an issue when using the Cutter Reverse Engineering Program, Here is a Segment of Decompiled Assembly, in Cutter :- at 0000:4ed5 in the picture I posted the .string line of text is there, ...
Edward Winch's user avatar
1 vote
1 answer
64 views

IDC script offsets

I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
AndS's user avatar
  • 11
1 vote
2 answers
188 views

Using IDA 8.3 Freeware on a Z180 .bin file

The last time I tried my hand at disassembly it was in 1986-1988... a Z80 embedded processor PROM image file... 42K of code turned into 27000+ lines of assembler code... using a disassembly program ...
Mike's user avatar
  • 21
3 votes
2 answers
260 views

Inspect executable binary similarity

I've found a company in China selling a software that is clearly a copy of my own work. For context, this is actually a physical product that comes with a Ubuntu computer and the software pre-...
AndroC's user avatar
  • 131
0 votes
0 answers
36 views

Getting IDA pro to understand that a "large" push can be two separate arguments?

I am reversing a large 16-bit DOS application compiled with a borland compiler. This often pushes one 32-bit value to the stack when a function takes two 16-bit arguments. Is there any way I can get ...
Kender's user avatar
  • 1
0 votes
0 answers
35 views

How to force IDA to understand that a given literal value is the bitwise combination of enum members?

I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this: FFFFFFFF ; ...
0xC0000022L's user avatar
  • 10.9k
0 votes
0 answers
53 views

IDA python : display not refreshing function parameters after type update

I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :) The issue : I have a ...
Jeremy's user avatar
  • 1
0 votes
1 answer
67 views

How to convert variable to struct member in IDA?

I'm working on a windows program which is walking PEB Ldr list. the related types are as follows: struct LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; // offset = 0, size = 0x10 ...
H3d9's user avatar
  • 3
0 votes
0 answers
37 views

How to get the byte offset of a type casted pointer in IDA PRO

v6 = v5 + 0x3E; if ( v5 + 0x1F >= 0 ) v6 = v5 + 0x1F; v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5); I want to get the byte offset pointer pointing at. Is there any way to get ...
msh's user avatar
  • 1
0 votes
0 answers
37 views

How can I map a binary that uses bank switching in IDA Pro?

Is it possible to memory map a binary that uses bank switching in IDA Pro? I'm trying to reverse engineer a binary for the Motorola 6800 architecture. The full 64Kb binary is mapped to the upper 32Kb ...
graphite_block's user avatar
1 vote
1 answer
140 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
0 votes
0 answers
61 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
Luiz's user avatar
  • 1
1 vote
1 answer
261 views

How to decode lua files and resource files that are protected from Frida and IDA64?

I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption. With Frida, the ...
xbuyk987's user avatar
0 votes
1 answer
65 views

IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available

I am trying to debug a dex file from an APK file in IDA Pro. I set some breakpoints when launching the activity. When I start the process, the application waits for the debugger. After some time, IDA ...
Quayyum Ali's user avatar
0 votes
0 answers
43 views

Using __usercall convention in IDA with non-x86 architecture

I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
Vadim  Yakovlev's user avatar
1 vote
1 answer
135 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
1 vote
0 answers
40 views

Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?

My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing From my research, I have come to the understanding that in order to extract the ipa ...
rasputin's user avatar
0 votes
1 answer
60 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
Ballers's user avatar
  • 49
0 votes
1 answer
68 views

IDA python API set function chunk end

I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
Tomer Attali's user avatar
1 vote
1 answer
130 views

Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?

In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
rasputin's user avatar
0 votes
1 answer
121 views

NameError: name 'ScreenEA' is not defined

Part of Practical malware analysis Lab5, is to run a python script in IDA Pro I have tried by going to Files-->Script command then I have pasted my python code: sea = ScreenEA() for i in range(...
Octo's user avatar
  • 1
0 votes
0 answers
64 views

What to expect from a Reverse Engineering technical test with IDA for a junior position? Experiences?

I'm excited about the prospect of taking a technical Reverse Engineering test for a junior position that I've been trying to secure. The test is expected to last around 3 hours, and I've been informed ...
Rusty's user avatar
  • 1
1 vote
0 answers
127 views

Trying To Understand DOS Game Assembly Instructions

I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html reading about how VGA Graphics work in ...
Edward Winch's user avatar
0 votes
2 answers
97 views

How does IDA know the symbol names for classes and interfaces?

I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
trxgnyp1's user avatar
  • 103
0 votes
0 answers
43 views

How to load correctly a SPC56AP54 dump in Ghidra or IDA?

I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
C0DER's user avatar
  • 51
0 votes
1 answer
69 views

Tool to analyze .obj files (not COFF) created with /LTCG

This Microsoft article states that: When building with LTCG, the compiler front end doesn't invoke the back end. Instead, it emits an OBJ file with IL in it. It bears repeating: this IL is not the ...
langlauf.io's user avatar
  • 1,550
2 votes
2 answers
209 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
1 vote
2 answers
91 views

how to access the initialized data in windbg through offset from IDA

In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
anonymous bear's user avatar
2 votes
1 answer
105 views

Problems with the display of constants in IDA Pro pseudocode

There is an elf x64 file, the pseudocode of IDA Pro 7.6 shows that a constant is 0xFFFFFFFD, but in fact it is "3" in the source code, how can I change it to show "3" in the ...
user6903's user avatar
  • 411
0 votes
1 answer
61 views

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

Is there an API which lets me programmatically: set the default string type (Setup) and rebuild the string list (Rebuild) ???
0xC0000022L's user avatar
  • 10.9k
0 votes
1 answer
93 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
1 vote
0 answers
64 views

Log functions called in IDA Pro?

When I run an exe in IDA how could I log which functions were called into a text file? log.txt: call func1 call func2 call func1 call func1 Not worried about indirect calls. This is for differential ...
Eva4684's user avatar
  • 11
1 vote
1 answer
103 views

Why I can't decompile this ARM function?

I have an ARM (thumb) function from Nokia's firmware: ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p ROM:10A5409C ROM:10A5409C var_18 = -0x18 ROM:...
raspiduino's user avatar
0 votes
0 answers
86 views

How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. Compression is RLE The game is from 1988 ...
The Thinker's user avatar
0 votes
0 answers
77 views

read params of int variable in ida?

I have located a known int variable that belongs to a tls library, the variable has parameters I need to look at to find the name of another variable I need. Is it possible to read the parameters?
Botytec's user avatar
0 votes
1 answer
86 views

idat.exe -S, path with spaces

I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so But I get an error. Among the logs is present the error: home\mypath: ...
Dario B.'s user avatar
0 votes
1 answer
41 views

idat.exe -S -A close without error

I have developed a idapython script and I run it using the following command: idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so In myscript.py I appended the exit(0) in order to ...
Dario B.'s user avatar
0 votes
1 answer
82 views

split function argument from IDA's hints

Suppose I have a function, I know that the first 4 arguments come with fixed registers. _BYTE *__fastcall foo(__int64 a1, _QWORD *a2, unsigned int a3, char a4, _QWORD *a5) For the fifth one, if I ...
anonymous bear's user avatar

1
2 3 4 5
43