Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
2,093
questions
0
votes
0
answers
29
views
Debug the DLL of an EXE using IDA Freeware
I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
- 1
1
vote
1
answer
95
views
How to decode lua files and resource files that are protected from Frida and IDA64?
I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption.
With Frida, the ...
- 53
0
votes
1
answer
51
views
IDA Pro: JDWP error:ABSENT_INFORMATION desired information is not avaiable
I am trying to debug a dex file in ida pro from an apk file.I set some breakpoint on launcing activity.When I start the proces the application wait for debugger.After some time Ida pro shows this JDWP:...
0
votes
0
answers
39
views
Using __usercall convention in IDA with non-x86 architecture
I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
1
vote
1
answer
94
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 33
1
vote
0
answers
27
views
Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?
My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing
From my research, I have come to the understanding that in order to extract the ipa ...
- 11
0
votes
1
answer
37
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
- 49
0
votes
1
answer
59
views
IDA python API set function chunk end
I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
0
votes
1
answer
66
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
- 11
0
votes
1
answer
59
views
NameError: name 'ScreenEA' is not defined
Part of Practical malware analysis Lab5, is to run a python script in IDA Pro
I have tried by going to Files-->Script command then I have pasted my python code:
sea = ScreenEA()
for i in range(...
- 1
0
votes
0
answers
63
views
What to expect from a Reverse Engineering technical test with IDA for a junior position? Experiences?
I'm excited about the prospect of taking a technical Reverse Engineering test for a junior position that I've been trying to secure. The test is expected to last around 3 hours, and I've been informed ...
- 1
1
vote
0
answers
113
views
Trying To Understand DOS Game Assembly Instructions
I am trying to understand assembly language instructions, for a DOS Game.
I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html
reading about how VGA Graphics work in ...
- 51
0
votes
2
answers
66
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
0
votes
0
answers
29
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
- 51
0
votes
1
answer
62
views
Tool to analyze .obj files (not COFF) created with /LTCG
This Microsoft article states that:
When building with LTCG, the compiler front end doesn't invoke the
back end. Instead, it emits an OBJ file with IL in it. It bears
repeating: this IL is not the ...
- 1,540
2
votes
2
answers
192
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
1
vote
2
answers
81
views
how to access the initialized data in windbg through offset from IDA
In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
- 301
2
votes
1
answer
97
views
Problems with the display of constants in IDA Pro pseudocode
There is an elf x64 file, the pseudocode of IDA Pro 7.6 shows that a constant is 0xFFFFFFFD, but in fact it is "3" in the source code, how can I change it to show "3" in the ...
- 411
0
votes
1
answer
50
views
How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?
Is there an API which lets me programmatically:
set the default string type (Setup) and
rebuild the string list (Rebuild)
???
- 10.9k
0
votes
1
answer
59
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
1
vote
0
answers
47
views
Log functions called in IDA Pro?
When I run an exe in IDA how could I log which functions were called into a text file?
log.txt:
call func1
call func2
call func1
call func1
Not worried about indirect calls.
This is for differential ...
- 11
1
vote
1
answer
92
views
Why I can't decompile this ARM function?
I have an ARM (thumb) function from Nokia's firmware:
ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p
ROM:10A5409C
ROM:10A5409C var_18 = -0x18
ROM:...
- 249
0
votes
0
answers
72
views
How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. Compression is RLE
The game is from 1988 ...
0
votes
0
answers
74
views
read params of int variable in ida?
I have located a known int variable that belongs to a tls library, the variable has parameters I need to look at to find the name of another variable I need. Is it possible to read the parameters?
- 1
0
votes
1
answer
67
views
idat.exe -S, path with spaces
I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so
But I get an error. Among the logs is present the error:
home\mypath: ...
- 1
0
votes
1
answer
30
views
idat.exe -S -A close without error
I have developed a idapython script and I run it using the following command:
idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so
In myscript.py I appended the exit(0) in order to ...
- 1
0
votes
1
answer
76
views
split function argument from IDA's hints
Suppose I have a function, I know that the first 4 arguments come with fixed registers.
_BYTE *__fastcall foo(__int64 a1, _QWORD *a2, unsigned int a3, char a4, _QWORD *a5)
For the fifth one, if I ...
- 301
1
vote
1
answer
133
views
How to quickly mark functions library in IDA Pro?
I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
- 33
2
votes
1
answer
153
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 123
1
vote
0
answers
47
views
How to remove a node in CTREE
Im learning about CTREE in IDA. Here is my ida decompiled code:
v3 = 0;
if ( !strcmp(Str1, "hello") )
v3 = 100;
return a1 + v3;
At this time, i just want to mess arround with CTREE ...
- 67
2
votes
2
answers
122
views
How to version control an IDA project?
I'm a git addict. Whenever I develop a C++, Python application, I need to version control it. For example, the csproj file managed by Visual Studio holds the compiling configurations for a C# project, ...
- 133
0
votes
1
answer
218
views
IDA Pro failed decompilation with "JUMPOUT"
I'm trying to reverse a crackme that is using jz x; mov eax, x+1; jmp eax pattern to confuse IDA. I have made a script to find all the patterns and disassemble from x+1 instead of x, but I'm running ...
- 3
1
vote
2
answers
222
views
How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. No idea how to open them. I tried Game ...
- 11
0
votes
2
answers
145
views
Disassemble MS-DOS 2.0 boot sector
I try disassemble boot sector for floppy 360K MS-DOS 2.0. There is code:
;bios parameter block here
seg000:001F db 0
seg000:0020 db 0Ah
seg000:0021 ...
- 323
1
vote
1
answer
55
views
Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)
"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, ...
- 13
1
vote
0
answers
135
views
Cyber Talent Basic Malware Reverse Engineering
I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find:
I have tried with Ghidra but i keep getting wrong submissions for the challenge.
Here is the exe ...
- 11
0
votes
1
answer
75
views
How to reverse a USB firmware patching tool for another device?
I have a USB device from a vendor (TRENDnet) that has the exact same chipset as a QNAP device with an available firmware patching tool.
It's my belief that this firmware patching tool should work ...
- 101
0
votes
0
answers
44
views
In the IDA xrefs window, can I filter by unique addresses? Or is there an alternative view providing that?
Consider the following screenshot:
Here, the r and p Type entries appear in pairs. We have ten entries, but five pairs.
Is there a way to filter this list down to unique Address values, rather than ...
- 10.9k
0
votes
0
answers
32
views
Teaching IDA to keep column width in xrefs window, or shortcut to quickly adjust them?
When invoking the function xrefs in IDA (8.2.230124), I can adjust the column widths and sorting or even the dialog size (here I adjusted only the width of the Address column):
IDA appears to ...
- 10.9k
2
votes
1
answer
81
views
other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?
atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
- 23
3
votes
0
answers
48
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
96
views
IDA Pro debugging an ARM binary on windows with QEMU
I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
- 31
3
votes
0
answers
104
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
3
votes
1
answer
90
views
Is there a way to find all constant pointers in IDA Pro?
I would like to know all the constants used for memory access except for non-pointer constants (e.g. argument) in IDA Pro.
Is there such a way?
- 31
2
votes
1
answer
126
views
Identify mod operation in ARM firmware with IDA
I have the firmware in which mod operation must be done. I want to find this part of instructions.
Assume the following logic exist in the firmware:
res = var % 17
I have tried to make search by % ...
- 21
2
votes
0
answers
72
views
IDA Pro Exports Table Corrupted!
I've been analyzing a dll file and naming the functions, structs, variables, and so on.
A lot of information has been changed and saved, but after the following message appears, the address column of ...
- 71
3
votes
0
answers
193
views
How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?
I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
3
votes
1
answer
59
views
Why are there more types in my ntoskrnl binary than my fltMgr binary?
I need the CONTROL_AREA Windows SDK structure to reverse fltMgr.sys. I see it in my ntoskrnl.i64 but not my fltMgr.i64 despite the fact they both only have ntddk64_win7 type library loaded. Why does ...
1
vote
1
answer
147
views
Where is the XOR operation?
I am doing TryHackMe REloaded room, level 3.
When I got stuck I followed this tutorial which mentions an XOR by 7 operation being performed on a string, however I cannot see it anywhere.
Where is it ...
- 185
4
votes
0
answers
115
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,767