Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
Luiz's user avatar
  • 1
1 vote
1 answer
95 views

How to decode lua files and resource files that are protected from Frida and IDA64?

I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption. With Frida, the ...
xbuyk987's user avatar
0 votes
1 answer
51 views

IDA Pro: JDWP error:ABSENT_INFORMATION desired information is not avaiable

I am trying to debug a dex file in ida pro from an apk file.I set some breakpoint on launcing activity.When I start the proces the application wait for debugger.After some time Ida pro shows this JDWP:...
Quayyum Ali's user avatar
0 votes
0 answers
39 views

Using __usercall convention in IDA with non-x86 architecture

I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
Vadim  Yakovlev's user avatar
1 vote
1 answer
94 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
1 vote
0 answers
27 views

Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?

My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing From my research, I have come to the understanding that in order to extract the ipa ...
rasputin's user avatar
0 votes
1 answer
37 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
Ballers's user avatar
  • 49
0 votes
1 answer
59 views

IDA python API set function chunk end

I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
Tomer Attali's user avatar
0 votes
1 answer
66 views

Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?

In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
rasputin's user avatar
0 votes
1 answer
59 views

NameError: name 'ScreenEA' is not defined

Part of Practical malware analysis Lab5, is to run a python script in IDA Pro I have tried by going to Files-->Script command then I have pasted my python code: sea = ScreenEA() for i in range(...
Octo's user avatar
  • 1
0 votes
0 answers
63 views

What to expect from a Reverse Engineering technical test with IDA for a junior position? Experiences?

I'm excited about the prospect of taking a technical Reverse Engineering test for a junior position that I've been trying to secure. The test is expected to last around 3 hours, and I've been informed ...
Rusty's user avatar
  • 1
1 vote
0 answers
113 views

Trying To Understand DOS Game Assembly Instructions

I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html reading about how VGA Graphics work in ...
Edward Winch's user avatar
0 votes
2 answers
66 views

How does IDA know the symbol names for classes and interfaces?

I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
trxgnyp1's user avatar
  • 103
0 votes
0 answers
29 views

How to load correctly a SPC56AP54 dump in Ghidra or IDA?

I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
C0DER's user avatar
  • 51
0 votes
1 answer
62 views

Tool to analyze .obj files (not COFF) created with /LTCG

This Microsoft article states that: When building with LTCG, the compiler front end doesn't invoke the back end. Instead, it emits an OBJ file with IL in it. It bears repeating: this IL is not the ...
langlauf.io's user avatar
  • 1,540
2 votes
2 answers
192 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
1 vote
2 answers
81 views

how to access the initialized data in windbg through offset from IDA

In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
anonymous bear's user avatar
2 votes
1 answer
97 views

Problems with the display of constants in IDA Pro pseudocode

There is an elf x64 file, the pseudocode of IDA Pro 7.6 shows that a constant is 0xFFFFFFFD, but in fact it is "3" in the source code, how can I change it to show "3" in the ...
user6903's user avatar
  • 411
0 votes
1 answer
50 views

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

Is there an API which lets me programmatically: set the default string type (Setup) and rebuild the string list (Rebuild) ???
0xC0000022L's user avatar
  • 10.9k
0 votes
1 answer
59 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
1 vote
0 answers
47 views

Log functions called in IDA Pro?

When I run an exe in IDA how could I log which functions were called into a text file? log.txt: call func1 call func2 call func1 call func1 Not worried about indirect calls. This is for differential ...
Eva4684's user avatar
  • 11
1 vote
1 answer
92 views

Why I can't decompile this ARM function?

I have an ARM (thumb) function from Nokia's firmware: ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p ROM:10A5409C ROM:10A5409C var_18 = -0x18 ROM:...
raspiduino's user avatar
0 votes
0 answers
72 views

How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. Compression is RLE The game is from 1988 ...
The Thinker's user avatar
0 votes
0 answers
74 views

read params of int variable in ida?

I have located a known int variable that belongs to a tls library, the variable has parameters I need to look at to find the name of another variable I need. Is it possible to read the parameters?
Botytec's user avatar
0 votes
1 answer
67 views

idat.exe -S, path with spaces

I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so But I get an error. Among the logs is present the error: home\mypath: ...
Dario B.'s user avatar
0 votes
1 answer
30 views

idat.exe -S -A close without error

I have developed a idapython script and I run it using the following command: idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so In myscript.py I appended the exit(0) in order to ...
Dario B.'s user avatar
0 votes
1 answer
76 views

split function argument from IDA's hints

Suppose I have a function, I know that the first 4 arguments come with fixed registers. _BYTE *__fastcall foo(__int64 a1, _QWORD *a2, unsigned int a3, char a4, _QWORD *a5) For the fifth one, if I ...
anonymous bear's user avatar
1 vote
1 answer
133 views

How to quickly mark functions library in IDA Pro?

I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
void_17's user avatar
  • 33
2 votes
1 answer
153 views

IDA: Demangled name simplification in idapython

With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them. For example, the following function: Python> ida_name.demangle_name(idc....
Blub's user avatar
  • 123
1 vote
0 answers
47 views

How to remove a node in CTREE

Im learning about CTREE in IDA. Here is my ida decompiled code: v3 = 0; if ( !strcmp(Str1, "hello") ) v3 = 100; return a1 + v3; At this time, i just want to mess arround with CTREE ...
Brian MJ's user avatar
2 votes
2 answers
122 views

How to version control an IDA project?

I'm a git addict. Whenever I develop a C++, Python application, I need to version control it. For example, the csproj file managed by Visual Studio holds the compiling configurations for a C# project, ...
Gqqnbig's user avatar
  • 133
0 votes
1 answer
218 views

IDA Pro failed decompilation with "JUMPOUT"

I'm trying to reverse a crackme that is using jz x; mov eax, x+1; jmp eax pattern to confuse IDA. I have made a script to find all the patterns and disassemble from x+1 instead of x, but I'm running ...
Alvo's user avatar
  • 3
1 vote
2 answers
222 views

How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. No idea how to open them. I tried Game ...
Fab's user avatar
  • 11
0 votes
2 answers
145 views

Disassemble MS-DOS 2.0 boot sector

I try disassemble boot sector for floppy 360K MS-DOS 2.0. There is code: ;bios parameter block here seg000:001F db 0 seg000:0020 db 0Ah seg000:0021 ...
black4's user avatar
  • 323
1 vote
1 answer
55 views

Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)

"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, ...
user3654535's user avatar
1 vote
0 answers
135 views

Cyber Talent Basic Malware Reverse Engineering

I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find: I have tried with Ghidra but i keep getting wrong submissions for the challenge. Here is the exe ...
Sheddymax's user avatar
0 votes
1 answer
75 views

How to reverse a USB firmware patching tool for another device?

I have a USB device from a vendor (TRENDnet) that has the exact same chipset as a QNAP device with an available firmware patching tool. It's my belief that this firmware patching tool should work ...
Geruta's user avatar
  • 101
0 votes
0 answers
44 views

In the IDA xrefs window, can I filter by unique addresses? Or is there an alternative view providing that?

Consider the following screenshot: Here, the r and p Type entries appear in pairs. We have ten entries, but five pairs. Is there a way to filter this list down to unique Address values, rather than ...
0xC0000022L's user avatar
  • 10.9k
0 votes
0 answers
32 views

Teaching IDA to keep column width in xrefs window, or shortcut to quickly adjust them?

When invoking the function xrefs in IDA (8.2.230124), I can adjust the column widths and sorting or even the dialog size (here I adjusted only the width of the Address column): IDA appears to ...
0xC0000022L's user avatar
  • 10.9k
2 votes
1 answer
81 views

other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?

atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
felipebubu's user avatar
3 votes
0 answers
48 views

How can I create an `__m128i` datatype with Frida?

I'm working on reversing a c++ binary and it has a function that I want to call with Frida. Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1); It doesn't seem ...
Myles Hollowed's user avatar
3 votes
0 answers
96 views

IDA Pro debugging an ARM binary on windows with QEMU

I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
Slava's user avatar
  • 31
3 votes
0 answers
104 views

IDA ATL C++ class reconstruction

I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
short dragon's user avatar
3 votes
1 answer
90 views

Is there a way to find all constant pointers in IDA Pro?

I would like to know all the constants used for memory access except for non-pointer constants (e.g. argument) in IDA Pro. Is there such a way?
user212942's user avatar
2 votes
1 answer
126 views

Identify mod operation in ARM firmware with IDA

I have the firmware in which mod operation must be done. I want to find this part of instructions. Assume the following logic exist in the firmware: res = var % 17 I have tried to make search by % ...
ALEX's user avatar
  • 21
2 votes
0 answers
72 views

IDA Pro Exports Table Corrupted!

I've been analyzing a dll file and naming the functions, structs, variables, and so on. A lot of information has been changed and saved, but after the following message appears, the address column of ...
short dragon's user avatar
3 votes
0 answers
193 views

How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?

I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
Eugene Muzychenko's user avatar
3 votes
1 answer
59 views

Why are there more types in my ntoskrnl binary than my fltMgr binary?

I need the CONTROL_AREA Windows SDK structure to reverse fltMgr.sys. I see it in my ntoskrnl.i64 but not my fltMgr.i64 despite the fact they both only have ntddk64_win7 type library loaded. Why does ...
EatingTechnobladesRemainsAt3am's user avatar
1 vote
1 answer
147 views

Where is the XOR operation?

I am doing TryHackMe REloaded room, level 3. When I got stuck I followed this tutorial which mentions an XOR by 7 operation being performed on a string, however I cannot see it anywhere. Where is it ...
securityauditor's user avatar
4 votes
0 answers
115 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,767

1
2 3 4 5
42