Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

Vtables in objects with inheritance in IDA

I'm struggling to get object inheritance working in IDA. The original structure is as follows: INoticeSource : INoticeSink IRTTITypeInfo : IUnknown, INoticeSource IPersist : IUnknown IPersistStream : ...
ZivDero's user avatar
0 votes
0 answers
25 views

Why a breakpoint works in x64dbg but not in IDA?

I've spent all morning trying to find a solution to debug with IDA the same function I'm debugging in x64dbg. In x64dbg, I just go to Symbols -> ws2_32.dll -> WSARecvFrom -> F2 (set ...
kuhi's user avatar
  • 161
0 votes
0 answers
22 views

Debug Linux Kernel ARM64

I need to extract Initramfs from the kernel. The initramfs archive itself is encrypted and located inside the kernel. I couldn't extract the key. I thought to run the kernel in Qemu, connect with the ...
Ren's user avatar
  • 1
0 votes
0 answers
45 views

How can I change the data type of `puVar1` in this C++ function?

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
hanan's user avatar
  • 309
0 votes
0 answers
24 views

How can i generate function call tree in IDA & proper disassembly from obsucated flow?

I'm trying to properly disassembly the following code in IDA but failing to do that because code flow is obfuscated with call / jnz byte ptr [eax-2] how is it supposed to look like for IDA? .text:...
M. Sol's user avatar
  • 1
0 votes
0 answers
31 views

IDA can't load DLL, possibly packed but how?

I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading: So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
HeckMeck's user avatar
1 vote
1 answer
86 views

Where is IDA getting this symbol?

I'm currently researching how a certain malware works and patches some stuff in a certain Android's library. Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
Arget's user avatar
  • 13
0 votes
1 answer
72 views

IDA Pro could not disassemble native function properly

Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly): Is it possible to produce manually more readable assembly?
AseN's user avatar
  • 161
0 votes
1 answer
63 views

Patch all calls to a single function using IDC

I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand ...
flying_meatball's user avatar
0 votes
2 answers
98 views

How to change default pointer size in IDA Pro

so, I'm writing a script to automate analysis, and the code I'm working with is 64bit. the pointer size field shown here is the wrong one: I want to change it from within python to 64bit. I've ...
serv0's user avatar
  • 11
0 votes
0 answers
35 views

Compiler settings for show main func in IDA

Why in dissasemble code in IDA, some programs have func "main" in begin (in start window in IDA) like this: cseg01:00038460 ; =============== S U B R O U T I N E =============================...
black4's user avatar
  • 333
0 votes
0 answers
50 views

(IDA/Windbg) break after run

I want to break/debug/stop execution on the first line just after I run/go. So, in other words, I debug a executable with a dialog box and a command button. I wait for the program to load the dialog ...
Uddie's user avatar
  • 1
1 vote
0 answers
61 views

Is it possible to run Ida pro in a docker container?

I've got a script that runs IDA pro on a file, the problem is that I need to run that script in a windows docker container. I've got the script working fine, but I can't get the program to run in the ...
Anthony's user avatar
  • 11
0 votes
1 answer
62 views

IDA breakpoint condition

How to set breakpoint condition that checks certain address value, for example: 0xD526C122 = FF. How can I make a counter that counts how many times breakpoint condition was met without actually ...
morkovni's user avatar
0 votes
0 answers
40 views

How to fix IDA not automatically updating the graph layout?

I installed IDA Free 8.3 and found that, unlike older versions, it doesn't automatically update the graph layout when I make a change. Say I have the following node: If I add a comment, I get this: ...
Matthew Hinson's user avatar
1 vote
0 answers
53 views

Why does IDA give variables a different name in Assembly and Pseudocode?

Why does IDA give variables a different name in Assembly and Pseudocode? In the picture below, you can see that IDA gives the stack location -38h the name var_38 in the Assembly view, but in the ...
Daniel's user avatar
  • 161
0 votes
0 answers
17 views

Is there a way to have multi-level key binds in IDA?

For example, in Visual Studio we can have 2-level key shortcuts: Alt+E,F to format selection, for example. In IDA when I press record and press Alt+E,F, it does record it, but the action is triggered ...
KulaGGin's user avatar
  • 316
0 votes
0 answers
52 views

Reverse engineering Objective-C blocks

I'm highly experienced with objective-c reverse engineering, but every time I encounter a block representation in the decompiler, right before it is passed as an argument to a function, I can ...
jony cachez's user avatar
0 votes
0 answers
35 views

Need SOME help decrypt xxtea encrypted Lua file from cocos2D game LIBRARY

iam trying from a while to figure out the key this cocos2dx game but couldn't figure it out if someone could abit help with the way to find these keys you check the the file from here https://github....
SHADOWDIANA's user avatar
0 votes
1 answer
65 views

Unable to run system Save As dialogue while debugging Notepad with IDA

I am trying to hook a function to Notepad.exe, so that it will encrypt a file when saving. I have dis-assembled it with IDA. I want to place breakpoints on the saving subroutine which I have ...
Yizhar Amir's user avatar
0 votes
0 answers
125 views

resolved IDA I get a warning "7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160)"

when trying to debug an application with IDA, I get the following warning: 7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160) After clicking Ok, I am taken to the kernelbase.dll line ...
Dan's user avatar
  • 1
0 votes
0 answers
36 views

Need help when reading .sam file of cocos2D game

so recently I tried to reverse a dead game apk to get their animation cause it's so unique that me and my friend want to remake it. But it took so long to just take each part of the image and combine ...
NoName's user avatar
  • 21
0 votes
0 answers
59 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
Ray's user avatar
  • 1,083
0 votes
0 answers
57 views

decode lua files cocos2dx and protected from Frida and IDA64 for hooking

I want to decode the lua and other resources files. But i cant find the key when i use frida or ida 64 it crash before the game start. Game is here https://megamonglobal.com/ https://imgur.com/88Habwu
xbuyk987's user avatar
0 votes
0 answers
64 views

Import function symbols from a reflection system into IDA

I'd like to import structs and functions from a reflection system into IDA. The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
KulaGGin's user avatar
  • 316
0 votes
1 answer
73 views

When parsing a C header file in IDA, is there a preprocessor symbol I can use to detect it?

IDA has the ability to parse C header files (by now a secondary option based on Clang also exists). It is useful to get structs and enums into your database via the Local Types view. Question: Aside ...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
219 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
R4444's user avatar
  • 1,797
0 votes
1 answer
64 views

My ida.reg file got deleted, is there any way to restore ida?

I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed - Is there any way to restore ida? ...
R4444's user avatar
  • 1,797
0 votes
0 answers
54 views

IDA Free Debugger slows down app substantially

I'm using IDA Free to decompile and debug an exectuable (a game, actually). When starting the debugger, the game runs really, really slow occasionally. Before, I have used Cheat Engine to debug the ...
Daniel's user avatar
  • 161
1 vote
0 answers
83 views

How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?

I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
LyZeN77's user avatar
  • 11
2 votes
1 answer
299 views

convert a memory location to string in Ghidra

I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well. I would like to have a decompiled pseudo-code in Ghidra like: ...
Iman Abdollahzadeh's user avatar
0 votes
0 answers
186 views

How to decrypt xxtea encrypt lua file from cocos2D game

I'm trying to decipher this game because it's about to be discontinued I tried to decompile the apk looking for image resources and lua files. Looking at the received title I guess that the game was ...
Neit's user avatar
  • 41
0 votes
1 answer
127 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
Edward Winch's user avatar
1 vote
0 answers
46 views

After loading additional files into an IDA database: can I process it, including applying PDB etc?

After loading an additional binary (.dll) file into an IDA database, is there a way to run it through a similar routine as would happen if the DLL had been loaded standalone? What I am aiming for is ...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
89 views

DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro

I am having an issue when using the Cutter Reverse Engineering Program, Here is a Segment of Decompiled Assembly, in Cutter :- at 0000:4ed5 in the picture I posted the .string line of text is there, ...
Edward Winch's user avatar
1 vote
1 answer
78 views

IDC script offsets

I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
AndS's user avatar
  • 11
1 vote
2 answers
315 views

Using IDA 8.3 Freeware on a Z180 .bin file

The last time I tried my hand at disassembly it was in 1986-1988... a Z80 embedded processor PROM image file... 42K of code turned into 27000+ lines of assembler code... using a disassembly program ...
Mike's user avatar
  • 21
3 votes
2 answers
283 views

Inspect executable binary similarity

I've found a company in China selling a software that is clearly a copy of my own work. For context, this is actually a physical product that comes with a Ubuntu computer and the software pre-...
AndroC's user avatar
  • 131
0 votes
0 answers
39 views

Getting IDA pro to understand that a "large" push can be two separate arguments?

I am reversing a large 16-bit DOS application compiled with a borland compiler. This often pushes one 32-bit value to the stack when a function takes two 16-bit arguments. Is there any way I can get ...
Kender's user avatar
  • 1
0 votes
0 answers
66 views

How to force IDA to understand that a given literal value is the bitwise combination of enum members?

I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this: FFFFFFFF ; ...
0xC0000022L's user avatar
  • 10.9k
0 votes
0 answers
62 views

IDA python : display not refreshing function parameters after type update

I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :) The issue : I have a ...
Jeremy's user avatar
  • 1
0 votes
1 answer
98 views

How to convert variable to struct member in IDA?

I'm working on a windows program which is walking PEB Ldr list. the related types are as follows: struct LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; // offset = 0, size = 0x10 ...
H3d9's user avatar
  • 3
0 votes
0 answers
49 views

How to get the byte offset of a type casted pointer in IDA PRO

v6 = v5 + 0x3E; if ( v5 + 0x1F >= 0 ) v6 = v5 + 0x1F; v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5); I want to get the byte offset pointer pointing at. Is there any way to get ...
msh's user avatar
  • 1
0 votes
0 answers
42 views

How can I map a binary that uses bank switching in IDA Pro?

Is it possible to memory map a binary that uses bank switching in IDA Pro? I'm trying to reverse engineer a binary for the Motorola 6800 architecture. The full 64Kb binary is mapped to the upper 32Kb ...
graphite_block's user avatar
1 vote
1 answer
356 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
0 votes
0 answers
101 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
Luiz's user avatar
  • 1
1 vote
1 answer
600 views

How to decode lua files and resource files that are protected from Frida and IDA64?

I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption. With Frida, the ...
xbuyk987's user avatar
0 votes
1 answer
71 views

IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available

I am trying to debug a dex file from an APK file in IDA Pro. I set some breakpoints when launching the activity. When I start the process, the application waits for the debugger. After some time, IDA ...
Quayyum Ali's user avatar
0 votes
0 answers
46 views

Using __usercall convention in IDA with non-x86 architecture

I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
Vadim  Yakovlev's user avatar
1 vote
1 answer
201 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33

1
2 3 4 5
43