Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0
votes
1answer
24 views

Creating table with IDAPython

I'd like to create the table like below, I could not found any clue while googling it. Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class? Any advises would ...
1
vote
0answers
44 views

Pascal string representation in Hex-Rays Decompiler of IDA Pro

I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below, now its type is char[25] due to inclusion of ...
1
vote
1answer
45 views

Ida Pro doesn't recognize known function

I open statically Arm binary with Ida Pro. While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example) ...
0
votes
1answer
22 views

How to load a pdb file from the hard drive with IDA Pro?

All the answers I see on Google are about how to load PDB files from online servers. But I have an exe I'm debugging. It's my own exe. Only reason I want to debug it, is so that I can step through ...
0
votes
0answers
20 views

Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step

I'm new to remote debugging so plz bare with me. I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
0
votes
0answers
23 views

IDA + Windbg does not break on sxe commands

I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
0
votes
1answer
45 views

What is most likely the reason causing this problem?

I'm trying to reverse engineering a obfuscated game, and when I import this related .so file into IDA, it output this : What technique is most likely been used in achieving such obfuscation ?
0
votes
0answers
42 views

Ida pro doesn't demangle all function names

I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are symbols in the firmware and I know function names but Ida didn't manage to demangle all function ...
1
vote
0answers
27 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
0
votes
2answers
50 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
0answers
14 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
0
votes
1answer
14 views

How to convert string to a variable in IDA

I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references: How can I do it? I am not sure what to choose here:
0
votes
1answer
60 views

IDA PRO decompiler expression last question (pseudocode)

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19); ..... shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory; ..... shellcode(&hkernel32, 0) If ...
0
votes
1answer
29 views

Undo step with IdaPython?

With Ida I can press Control+Z to undo the last action Can I do that with IdaPython?
0
votes
0answers
37 views

IDAPython: error executing init.py:

When I open Ida Pro 7.3 I see an error message IDAPython: error executing init.py: nothing to repeat Refer to the message window to see the full error log. How can I understand what is the problem? ...
0
votes
0answers
24 views

Get first and last address of binary with IdaPython

How can I get the first and last address of binary with IdaPython?
0
votes
1answer
45 views

Add python to Ida Pro 7.3

I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script. How can I add Python to Ida , So I can run Python script via IDA ?
0
votes
1answer
137 views

What does this function do?

I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
0
votes
2answers
104 views

How to debug / analyze a Themida protected binary

Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation: STACK_TEXT: 03799f54 00f91cfa 24d1ae78 0000000f ...
1
vote
1answer
120 views

IDA Pro shows an array where two varaibles should be

I'm working in a Delphi binary and found a little issue while generating pseudocode. This is the output (after some clean up) that IDA gives me: Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
0
votes
0answers
14 views

IDA doesn't create Elf32_Sym struct and thus no export for shared object dumped using Frida

I am reverse engineering a program which decrypts encrypted .so file runtime. It seems like they encrypt-decrypt only partially, because the decrypted file and encrypted file matches up to 0x4893D07. ...
0
votes
0answers
15 views

IDA PRO changing Assembly instructions to redirect end of function

I have a piece of malware and in one of its functions there is a switch statement. At one of the branches instead of jumping to a specified location it is ending the function resulting in a "sp-...
0
votes
0answers
39 views

viewing debugging symbols in windbg

I am currently learning Malware Analysis using the book "Practical Malware Analysis", and I am going along with the chapter on Kernel debugging. When viewing the same code snippet on WinDbg ...
2
votes
2answers
99 views

IDA PRO Hex-Rays try-catch

I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice. I've been searching and it seems like IDA does not support them so I was wondering if there is ...
0
votes
1answer
29 views

Debugging Native Lib using IDA Pro Fails to Load Registers and other Information

Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
3
votes
0answers
39 views

Cannot load pdb in IDA Free 7.6

I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach. I have just installed the last version of free IDA (7.6) ...
1
vote
2answers
62 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1answer
51 views

IDA Pro 7.5 Breakpoint Python Script: 'invalid non-printable character U+FEFF'

I'm trying to set a python condition breakpoint, but it throws me a weird error and I don't understand what happens: Even if I just return True, it throws the same error when I compile or when press &...
1
vote
0answers
44 views

IDA Pro don't understand address extension register in HC16

Source: ROM:13A2 006 ldab #0Fh ; Load B ROM:13A4 006 ldx #0FA27h ; Load IX ROM:13A8 006 tbxk ; Transfer B ...
1
vote
0answers
28 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
-1
votes
1answer
51 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
2
votes
1answer
94 views

How to analyze dumped process?

I'm trying to reverse engineer a malware which uses a Process Hollow technique. This malware uses an API hashing technique and contains some RC4 encryption algorithm references. I already knew the ...
0
votes
1answer
45 views

IDA Pro Debbuger is debugging the original code and not the patched code

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections?...
0
votes
0answers
23 views

How to replace the modified/corrupted module image on the original in the memory dump

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
1
vote
0answers
52 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
0
votes
0answers
42 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
0
votes
0answers
27 views

Indirect calls using registers (IDA)

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
0
votes
0answers
64 views

IDA: Function arguments detection

I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. ...
2
votes
1answer
61 views

How to know when a subroutine starts when reversing an ARM64 file?

I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
1
vote
1answer
42 views

Display open handles in IDA pro, just like xdbg?

I want to know for example that if a ReadFile is happening and the handle number is 100, which file or whatever this handle belongs to? lets assume for whatever reason i cannot trace CreateFiles to ...
1
vote
0answers
77 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
0
votes
0answers
36 views

Basic Block generated by IDAPython code are different compared to BN generated output file

I have a query regarding different BB count using two different tools. I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to ...
1
vote
0answers
25 views

How to move function names, comments, local variable names and structs to a database for a new version of the executable?

I have reversed a number of functions and added definitions for some structs in an Intel x64 PE executable. A program got an update. I moved old executable with the old database into another folder ...
4
votes
1answer
149 views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
0
votes
1answer
61 views

Imports shifting in the dump

dumped the PE using scylla, analysing without issues but when i trying to inspect codes i see what IDA analysed imports incorrect, means i see for example MapViewOfFile which according by pseudo not ...
0
votes
1answer
61 views

Adding signatures to Ghidra

I have a couple of questions about the Ghidra I am analyzing a binary file and in the binary it uses a functions from libstdc++. What is the best way to add the signatures of functions from "...
0
votes
1answer
36 views

Paint path in Ida according to gdb log file

In Gdb I put script that print each instruction to gdb.txt file. I want to load this file to Ida to show and print/paint the path that the process has been running. The gdb script is # not strictly ...
1
vote
1answer
55 views

Debug bFLT in qemu-arm-static

I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static . I want to debug that binary dynamically with GDB. I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
0answers
28 views

Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point

Here's the problem: I set a breakpoint in IDA debugger the program stop at the breakpoint deactivated the breakpoint IDA keep receiving SIGTRAP or SIGSEGV ( program stop at breakpoint as expected ) :...
1
vote
1answer
79 views

Why IDA debugger on android doesn't show all threads?

My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file. Here's what I've done: download a x86_64 system image android emulator from android studio install that .apk ...

1
2 3 4 5
37